Nothing Special   »   [go: up one dir, main page]

WO2023072275A1 - 通信方法、装置及系统 - Google Patents

通信方法、装置及系统 Download PDF

Info

Publication number
WO2023072275A1
WO2023072275A1 PCT/CN2022/128443 CN2022128443W WO2023072275A1 WO 2023072275 A1 WO2023072275 A1 WO 2023072275A1 CN 2022128443 W CN2022128443 W CN 2022128443W WO 2023072275 A1 WO2023072275 A1 WO 2023072275A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
anonymous
network
information
terminal device
Prior art date
Application number
PCT/CN2022/128443
Other languages
English (en)
French (fr)
Inventor
李�赫
吴�荣
胡力
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22886150.6A priority Critical patent/EP4422235A1/en
Publication of WO2023072275A1 publication Critical patent/WO2023072275A1/zh
Priority to US18/650,700 priority patent/US20240284174A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities

Definitions

  • the present application relates to the communication field, and in particular to a communication method, device and system.
  • Existing authentication includes two ways. One way is to complete the authentication process between the authentication authorization accounting server (authentication authorization accounting, AAA) server and the terminal device.
  • the AAA server does not belong to the identity that provides network services for the terminal device.
  • Authentication server function The network to which the AUSF (authentication server function, AUSF) network element belongs can be referred to as the external authentication method for short; the other method is that the AUSF network element and the terminal device complete the authentication process, and the AUSF network element and the terminal device belong to the same
  • the network may be referred to as an internal authentication mode for short. Exemplarily.
  • the authentication process may include the network authenticating the terminal device and the terminal device authenticating the network, preventing illegal terminal devices from occupying network resources, and preventing terminal devices from entering illegal networks and being defrauded of key information.
  • Embodiments of the present application provide a communication method, device, and system, which provide a scheme for determining an authentication mode, and can determine a mode for authenticating a terminal device.
  • a communication system includes: unified data management, and authentication server functions. in,
  • the authentication server function is used to send an authentication acquisition request message to the unified data management.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier
  • the anonymous subscription concealment identifier includes anonymous domain information
  • the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • Unified data management used to receive the authentication acquisition request message from the authentication server function, determine the authentication method for authenticating the terminal device according to the anonymous domain information and configuration information, and send the authentication acquisition response message to the authentication server function .
  • the authentication mode includes an external authentication mode or an internal authentication mode
  • the configuration information includes one or more network identities corresponding to the external authentication mode and/or one or more network identities corresponding to the internal authentication mode.
  • the authentication acquisition response message includes authentication indication information indicating an authentication mode and an anonymous subscription permanent identifier.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • the authentication server function is also used to receive an authentication acquisition response message from the unified data management, and send an authentication request message to the authentication and authorization functions specific to network slices and independent non-public networks according to the authentication indication information.
  • the authentication request message is used to request authentication of the terminal device, and the authentication request message includes an anonymous subscription permanent identifier.
  • the unified data management receives the anonymous subscription hidden identifier including the anonymous domain information, the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs, according to the anonymous
  • the domain information and the configuration information determine the authentication indication information, the authentication indication information is used to indicate the authentication mode, and the configuration information includes the identifiers of one or more networks corresponding to the external authentication mode, and/or the identification of one or more networks corresponding to the internal authentication mode. The identification of one or more networks, such that the means by which the terminal device can be authenticated can be successfully determined.
  • the anonymous subscription concealment identifier may further include anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • the communication system provided in the first aspect may also include network slicing and independent non-public network-specific authentication and authorization functions.
  • the authentication response message may include a real subscription permanent identifier and/or an authentication success message
  • the real subscription permanent identifier may include real user name information
  • the real user name information may be used to identify the terminal device
  • the authentication success message may be used to indicate The terminal device is authenticated successfully.
  • the authentication server function is also used to receive authentication response messages from authentication and authorization functions specific to network slices and independent non-public networks.
  • an authentication result confirmation request message is sent to the unified data management.
  • the authentication result confirmation request message may include the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • Unified data management is also used to receive the authentication result confirmation request message from the authentication server function, and save the real subscription permanent identification and authentication result indication information.
  • the authentication server function determines whether the real subscription permanent identifier used in the authentication process of the external authentication device is the same as the real subscription permanent identifier on the terminal device side according to the anonymous domain information and the real domain information, and if they are the same, it can The two-way authentication between the terminal device and the network side is completed, the terminal device believes that the network is real, and the network believes that the terminal device is real.
  • the authentication response message may also include a root key.
  • the authentication server function is also used to generate an intermediate key based on the root key and the real signed permanent identity.
  • the authentication response message also includes a root key
  • the communication system provided in the first aspect may also include: access and mobility management functions, network slicing, and independent non-public network-specific authentication and authorization Function.
  • Network slice and independent non-public network-specific authentication and authorization functions for receiving authentication request messages from the authentication server function.
  • the authentication response message includes the real subscription permanent identifier and/or authentication success message
  • the real subscription permanent identifier includes real user name information
  • the real user name information is used to identify the terminal device
  • the authentication success message is used to indicate that the terminal device is authenticated. right to success.
  • the authentication server function is also used to receive authentication response messages from authentication and authorization functions specific to network slices and independent non-public networks.
  • first network-side verification information is generated according to the root key, the real subscription permanent identifier, and the network-side counter value.
  • An authentication authentication response message is sent to the access and mobility management function, where the authentication authentication response message includes an authentication success message, first verification information on the network side, and a counter value on the network side.
  • the access and mobility management function is used to receive the authentication response message from the authentication server function, and send the non-access stratum security mode command message to the terminal device.
  • the non-access stratum security mode command message includes an authentication success message, first verification information on the network side, and a counter value on the network side.
  • the access and mobility management function is also used to send an authentication authentication intermediate message to the authentication server function.
  • the authentication authentication intermediate message includes the second verification information on the terminal side and the counter value on the terminal side.
  • the authentication server function is also used to receive the authentication authentication intermediate message from the access and mobility management function. Generate second verification information on the network side according to the root key, the real subscription permanent identifier and the counter value on the terminal side. It is judged whether the second verification information on the terminal side is consistent with the second verification information on the network side. If the second verification information on the terminal side is consistent with the second verification information on the network side, an authentication result confirmation request message is sent to the unified data management. Wherein, the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • Unified data management is also used to receive an authentication result confirmation request message from the authentication server function. Save the real subscription permanent identifier and authentication result indication information.
  • the terminal device thinks the network is real, and the network thinks the terminal device is real.
  • the authentication server function is also used to generate an intermediate key according to the root key, and generate first network-side verification information according to the intermediate key, the real contract permanent identifier and the network-side counter value.
  • the real subscription permanent identifier is used to generate the first verification information on the network side.
  • the terminal device can confirm whether the real subscription permanent identifier used by the authenticating device for authentication is the same as the real subscription permanent identifier of the terminal device. .
  • the authentication response message further includes a root key
  • the communication system may further include: access and mobility management functions, network slicing and independent non-public network-specific authentication and authorization functions.
  • Authentication and authorization functions specific to network slices and independent non-public networks are used to receive authentication request messages from the authentication server function and send authentication response messages to the authentication server function.
  • the authentication response message includes the real subscription permanent identifier, the authentication success message, and the root key
  • the real subscription permanent identifier includes the real username information
  • the real username information is used to identify the terminal device
  • the authentication success message is used to indicate the Device authentication is successful.
  • the authentication server function is also used to receive authentication response messages from authentication and authorization functions specific to network slices and independent non-public networks. Send an authentication authentication response message to the access and mobility management function.
  • the authentication authentication response message includes the real subscription permanent identifier, and/or the authentication success message, and the intermediate key Kseaf.
  • the access and mobility management function is used to receive the authentication response message from the authentication server function, and send the non-access stratum security mode command message to the terminal device.
  • the non-access stratum security mode command message includes an authentication success message.
  • the access and mobility management function is also used to send an authentication result message to the authentication server function.
  • the authentication result message includes authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the authentication server function is also used to receive the authentication result message from the access and mobility management function. Send an authentication result response message to the access and mobility management function.
  • the access and mobility management function is also used to receive the authentication result response message from the authentication server function.
  • the authentication server function is further configured to send an authentication result confirmation request message to the unified data management in response to the authentication result indication information.
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information.
  • Unified data management is also used to receive the authentication result confirmation request message from the authentication server function, and save the real subscription permanent identification and authentication result indication information.
  • the non-access layer security mode command process is executed. If the non-access layer security mode command process is successful, it can be concluded that the real subscription permanent identifier used for authentication is the same as the real subscription permanent identifier of the terminal device, thus The identity information corresponding to the credential used by the external authentication device in the authentication process is the same as the identity information corresponding to the credential on the terminal device side. In this way, the two-way authentication between the terminal device and the network side can be completed, the terminal device believes that the network is real, and the network believes that the terminal device is real.
  • the communication system described in the first aspect may further include: an external authentication device.
  • the external authentication device is used to receive protocol request messages from network slices and independent non-public network-specific authentication and authorization functions, authenticate terminal devices, and send them to network slices and independent non-public network-specific authentication and authorization functions Protocol response message.
  • the protocol request message may include the anonymous subscription permanent identifier, or include the anonymous domain information and not include information other than the anonymous domain information in the anonymous subscription permanent identifier.
  • the protocol response message may include the real subscription permanent identifier, and may also include an authentication success message, and/or a root key. In this way, the terminal device can be authenticated in an external authentication manner.
  • a communication method includes: receiving an authentication acquisition request message from an authentication server function, determining an authentication mode for authenticating a terminal device according to anonymous domain information and configuration information, and sending an authentication acquisition response message to the authentication server function .
  • the authentication acquisition request message includes an anonymous subscription concealment identifier
  • the anonymous subscription concealment identifier includes anonymous domain information
  • the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication mode includes an external authentication mode or an internal authentication mode
  • the configuration information includes identifiers of one or more networks corresponding to the external authentication mode and/or identifiers of one or more networks corresponding to the internal authentication mode.
  • the authentication acquisition response message includes authentication indication information for indicating the authentication mode.
  • the determination of the authentication method for authenticating the terminal according to the domain information and configuration information may include: identifying the network identifier of the authentication device capable of authenticating the terminal device and the external If the identifiers of one or more networks corresponding to the authentication mode match, it is determined that the authentication mode for authenticating the terminal device is an external authentication mode. Or, if the identity of the network to which the authentication device belongs that can authenticate the terminal device matches the identity of one or more networks corresponding to the internal authentication method, determine the authentication method for authenticating the terminal device It is the internal authentication method.
  • the authentication acquisition response message further includes an anonymous signing permanent identifier
  • the anonymous signing permanent identifier is determined according to the anonymous signing hidden identifier
  • the anonymous signing permanent identifier includes anonymous domain information
  • the hidden identity of the anonymous subscription further includes anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • the communication method provided by the second aspect may further include: receiving an authentication result confirmation request message from the authentication server function, and storing the real subscription permanent identifier and the authentication result indication information.
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the real subscription permanent identifier includes real user name information, and the real user name information is used to identify the terminal device.
  • a communication method includes: sending an authentication acquisition request message to the unified data management, receiving an authentication acquisition response message from the unified data management, and sending the authentication to the authentication and authorization functions specific to the network slice and the independent non-public network according to the authentication indication information
  • the request message receives the authentication response message from the authentication and authorization functions specific to the network slice and the independent non-public network, and sends an authentication result confirmation request message to the unified data management when the real domain information matches the anonymous domain information.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier
  • the anonymous subscription concealment identifier includes anonymous domain information
  • the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication acquisition response message includes authentication indication information and an anonymous subscription permanent identifier, and the authentication indication information is used to indicate an authentication mode for authenticating the terminal device.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • Authentication methods include external authentication methods or internal authentication methods. The authentication request message is used to request authentication of the terminal device, and the authentication request message includes an anonymous subscription permanent identifier.
  • the authentication response message includes the real subscription permanent identifier and/or authentication success message
  • the real subscription permanent identifier includes real user name information
  • the real user name information is used to identify the terminal device
  • the authentication success message is used to indicate that the terminal device is successfully authenticated .
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the authentication response message further includes a root key
  • the communication method provided by the third aspect may further include: generating an intermediate key according to the root key and the real signing permanent identifier.
  • the hidden identity of the anonymous subscription further includes anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • a communication method includes: sending an authentication acquisition request message to the unified data management, receiving an authentication acquisition response message from the unified data management, and sending the authentication to the authentication and authorization function specific to the network slice and the independent non-public network according to the authentication indication information
  • the request message receives the authentication response message from the authentication and authorization functions specific to the network slice and the independent non-public network, and generates the network-side second One authentication information, send an authentication authentication response message to the access and mobility management function, the authentication authentication response message includes the authentication success message, the first authentication information on the network side and the counter value on the network side, and receive the information from the access and mobility management function
  • the authentication authentication intermediate message of the function generates the second verification information on the network side according to the root key, the real subscription permanent identifier and the counter value on the terminal side. It is judged whether the second verification information on the terminal side is consistent with the second verification information on the network side. If the second verification information on the terminal side is consistent with the second verification information on the network side, an authentication result confirmation request
  • the authentication acquisition request message includes an anonymous subscription concealment identifier, and the anonymous subscription concealment identifier includes anonymous domain information, and the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication acquisition response message includes authentication indication information and an anonymous subscription permanent identifier, and the authentication indication information is used to indicate an authentication mode for authenticating the terminal device.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • Authentication methods include external authentication methods or internal authentication methods.
  • the authentication request message is used to request the terminal device to be authenticated, and the authentication request message includes the permanent identity of the anonymous contract.
  • the authentication response message includes the real subscription permanent identifier, the authentication success message and the root key.
  • the real subscription permanent identifier includes the real user name information, the real username information is used to identify the terminal device, and the authentication success message is used to indicate that the terminal device is authenticated. success.
  • the authentication authentication intermediate message includes the second verification information on the terminal side and the counter value on the terminal side.
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information.
  • the hidden identity of the anonymous subscription further includes anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • the above-mentioned generation of the first verification information on the network side according to the root key, the real contract permanent identifier and the network side counter value includes: generating an intermediate key according to the root key, and generating an intermediate key according to the intermediate key, The real subscription permanent identifier and the counter value on the network side generate the first verification information on the network side.
  • a communication method includes: sending an authentication acquisition request message to the unified data management. Receive an authentication acquisition response message from the unified data management. According to the authentication indication information, an authentication request message is sent to the authentication and authorization functions specific to the network slice and the independent non-public network. Receive authentication response messages from authentication and authorization functions specific to network slices and independent non-public networks. Send an authentication authentication response message to the access and mobility management function. An authentication authentication result message is received from the access and mobility management function. In response to the authentication result indication information, an authentication result confirmation request message is sent to the unified data management.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier
  • the anonymous subscription concealment identifier includes anonymous domain information
  • the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication acquisition response message includes authentication indication information and an anonymous subscription permanent identifier, and the authentication indication information is used to indicate an authentication mode for authenticating the terminal device.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • Authentication methods include external authentication methods or internal authentication methods. The authentication request message is used to request authentication of the terminal device, and the authentication request message includes an anonymous subscription permanent identifier.
  • the authentication response message includes the real subscription permanent identifier and/or authentication success message, the real subscription permanent identifier includes real user name information, the real user name information is used to identify the terminal device, and the authentication success message is used to indicate that the terminal device is successfully authenticated .
  • the authentication authentication response message includes the real subscription permanent identifier and/or authentication success message.
  • the authentication authentication result message includes authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information.
  • the authentication response message further includes a root key
  • the communication method provided in the fifth aspect may further include: generating an intermediate key according to the root key.
  • the hidden identity of the anonymous subscription further includes anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • a communication method includes: in the case of not obtaining the public key, determining the hidden identity of the anonymous subscription, and sending a registration request message to the access and mobility management function.
  • the hidden identity of the anonymous subscription includes anonymous domain information, anonymous user name information and routing indicator.
  • the anonymous domain information is used to indicate the identity of the network to which the authentication device that can authenticate the terminal device belongs.
  • the anonymous user name information is the default value.
  • the registration request message includes an anonymous subscription hidden identifier.
  • the communication method provided in the sixth aspect may further include: performing an authentication process with an external authentication device, generating a root key, and receiving a non-access request from the access and mobility management function Layer security mode command message, the non-access layer security mode command message includes authentication success message, in response to the authentication success message, according to the root key and the real subscription permanent identifier, generate an intermediate key.
  • the authentication success message is used to indicate that the authentication of the terminal device is successful.
  • the real subscription permanent identifier includes real user name information, and the real user name information is used to identify the terminal device.
  • the communication method provided in the sixth aspect may further include: executing an authentication process with an external authentication device, and generating a root key.
  • Receive the non-access stratum security mode command message from the access and mobility management function respond to the authentication success message, generate the first verification information on the terminal side according to the root key, the real subscription permanent identifier and the network side counter value, and judge Whether the first verification information on the terminal side is consistent with the first verification information on the network side.
  • the first verification information on the terminal side is consistent with the first verification information on the network side, generate second verification information on the terminal side according to the root key, the real subscription permanent identifier and the counter value on the terminal side.
  • the non-access stratum security mode command message includes authentication success message, network-side first verification information and network-side counter value, and the authentication success message is used to indicate successful authentication of the terminal device.
  • the real subscription permanent identifier includes real user name information, and the real user name information is used to identify the terminal device.
  • the N1 message includes the second verification information on the terminal side and the counter value on the terminal side.
  • the above-mentioned generation of the first verification information on the terminal side according to the root key, the real subscription permanent identifier and the network side counter value may include: generating an intermediate key according to the root key, and generating an intermediate key according to the intermediate key , the real subscription permanent identifier and the counter value on the network side to generate first verification information on the terminal side.
  • a communication method includes: receiving a registration request message from a terminal device, sending an authentication request message to an authentication server function, receiving an authentication response message from the authentication server function, and successfully executing the non-access layer security mode with the terminal device In the case of the command flow, send the authentication result message to the authentication server function.
  • the registration request message includes an anonymous subscription hidden identifier
  • the anonymous signed hidden identifier includes anonymous domain information, anonymous user name information, and a routing indicator
  • the anonymous domain information is used to indicate the identity of the network to which the authentication device capable of authenticating the terminal device belongs.
  • ID anonymous username information is the default.
  • the authentication authentication request message includes the hidden identity of the anonymous contract.
  • the authentication authentication response message includes a real subscription permanent identifier and/or an authentication success message, the real subscription permanent identifier includes real user name information, the real user name information is used to identify the terminal device, and the authentication success message is used to indicate that the terminal device is authenticated. right to success.
  • the authentication and authentication result message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • a communication method includes: receiving an authentication request message from an authentication server function, receiving a protocol response message from an external authentication device, judging whether the anonymous domain information matches the real domain information, and if the real domain information matches the anonymous domain information, Send an authentication response message to the authentication server function.
  • the authentication request message may include an anonymous subscription permanent identifier.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • the protocol response message may include the real subscription permanent identifier, and may also include an authentication success message, and/or a root key.
  • the authentication response message may include authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the hidden identity of the anonymous subscription further includes anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • a communication device in a ninth aspect, includes: a processing module and a transceiver module.
  • the transceiver module is used for receiving the authentication acquisition request message from the authentication server function.
  • the processing module is configured to determine an authentication mode for authenticating the terminal device according to the anonymous domain information and configuration information.
  • the transceiver module is also used to send an authentication acquisition response message to the authentication server function.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier
  • the anonymous subscription concealment identifier includes anonymous domain information
  • the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication mode includes an external authentication mode or an internal authentication mode
  • the configuration information includes identifiers of one or more networks corresponding to the external authentication mode and/or identifiers of one or more networks corresponding to the internal authentication mode.
  • the authentication acquisition response message includes authentication indication information for indicating the authentication mode.
  • the processing module when the identification of the network to which the authentication device that can authenticate the terminal device belongs matches the identification of one or more networks corresponding to the external authentication mode, the processing module also uses The authentication method used to determine the authentication of the terminal device is an external authentication method. Alternatively, when the identity of the network to which the authentication device belongs that can authenticate the terminal device matches the identity of one or more networks corresponding to the internal authentication mode, the processing module is further configured to determine that the terminal device is authenticated.
  • the authentication mode of authentication is the internal authentication mode.
  • the authentication acquisition response message further includes an anonymous signing permanent identifier
  • the anonymous signing permanent identifier is determined according to the anonymous signing hidden identifier
  • the anonymous signing permanent identifier includes anonymous domain information
  • the hidden identity of the anonymous subscription further includes anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • the transceiver module is further configured to receive an authentication result confirmation request message from the authentication server function.
  • the communication device may further include a storage module, which is used to store the real subscription permanent identifier and the authentication result indication information.
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the real subscription permanent identifier includes real user name information, and the real user name information is used to identify the terminal device.
  • the transceiver module described in the ninth aspect may include a receiving module and a sending module.
  • the receiving module is used to receive data and/or signaling from the authentication server function and/or other network elements;
  • the sending module is used to send data and/or signaling to the authentication server function and/or other network elements .
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the ninth aspect can execute the method described in the second aspect.
  • the communication device described in the ninth aspect may be a unified data management, or a chip (system) or other components or components that can be set in the unified data management, which is not limited in this application.
  • a communication device in a tenth aspect, includes: a processing module and a transceiver module.
  • the transceiver module is configured to send an authentication acquisition request message to the unified data management.
  • the transceiver module is also used to receive the authentication acquisition response message from the unified data management.
  • the processing module is configured to send an authentication request message to the authentication and authorization functions specific to the network slice and the independent non-public network according to the authentication indication information.
  • the transceiver module is also used for receiving authentication response messages from authentication and authorization functions specific to network slices and independent non-public networks.
  • the transceiver module is further configured to send an authentication result confirmation request message to the unified data management.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier
  • the anonymous subscription concealment identifier includes anonymous domain information
  • the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication acquisition response message includes authentication indication information and an anonymous subscription permanent identifier, and the authentication indication information is used to indicate an authentication mode for authenticating the terminal device.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • Authentication methods include external authentication methods or internal authentication methods. The authentication request message is used to request authentication of the terminal device, and the authentication request message includes an anonymous subscription permanent identifier.
  • the authentication response message includes the real subscription permanent identifier and/or authentication success message
  • the real subscription permanent identifier includes real user name information
  • the real user name information is used to identify the terminal device
  • the authentication success message is used to indicate that the terminal device is successfully authenticated .
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the authentication response message also includes the root key.
  • the processing module is also used to generate an intermediate key according to the root key and the real signed permanent identification.
  • the hidden identity of the anonymous subscription further includes anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • the transceiver module described in the tenth aspect may include a receiving module and a sending module.
  • the receiving module is used to receive data and/or signaling from network slices and independent non-public network-specific authentication and authorization functions, access and mobility management functions, unified data management, and/or other network elements;
  • the module is used to send data and/or signaling to network slice and independent non-public network specific authentication and authorization functions, access and mobility management functions, unified data management, and/or other network elements.
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the tenth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the tenth aspect can execute the method described in the third aspect.
  • the communication device described in the tenth aspect may be an authentication server function, or a chip (system) or other components or components that may be configured in the authentication server function, which is not limited in this application.
  • a communication device in an eleventh aspect, includes: a processing module and a transceiver module.
  • the transceiver module is configured to send an authentication acquisition request message to the unified data management.
  • the transceiver module is also used to receive the authentication acquisition response message from the unified data management.
  • the transceiver module is also used to send an authentication request message to the authentication and authorization functions specific to the network slice and the independent non-public network according to the authentication indication information.
  • the transceiver module is also used for receiving authentication response messages from authentication and authorization functions specific to network slices and independent non-public networks.
  • the processing module is configured to generate the first network-side verification information according to the root key, the real subscription permanent identifier and the network-side counter value in response to the authentication success message.
  • the transceiver module is further configured to send an authentication response message to the access and mobility management function, where the authentication response message includes an authentication success message, first verification information on the network side, and a counter value on the network side.
  • the transceiver module is also used to receive the authentication authentication intermediate message from the access and mobility management function.
  • the processing module is further configured to generate second verification information on the network side according to the root key, the real subscription permanent identifier and the counter value on the terminal side.
  • the processing module is further configured to determine whether the second verification information on the terminal side is consistent with the second verification information on the network side. When the second verification information on the terminal side is consistent with the second verification information on the network side, the transceiver module is further configured to send an authentication result confirmation request message to the unified data management.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier, and the anonymous subscription concealment identifier includes anonymous domain information, and the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication acquisition response message includes authentication indication information and an anonymous subscription permanent identifier, and the authentication indication information is used to indicate an authentication mode for authenticating the terminal device.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • Authentication methods include external authentication methods or internal authentication methods.
  • the authentication request message is used to request authentication of the terminal device, and the authentication request message includes an anonymous subscription permanent identifier.
  • the authentication response message includes the real subscription permanent identifier, the authentication success message and the root key.
  • the real subscription permanent identifier includes the real user name information, the real username information is used to identify the terminal device, and the authentication success message is used to indicate that the terminal device is authenticated. success.
  • the authentication authentication intermediate message includes the second verification information on the terminal side and the counter value on the terminal side.
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the hidden identity of the anonymous subscription further includes anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • the processing module is further configured to generate an intermediate key according to the root key, and generate first verification information on the network side according to the intermediate key, the real contract permanent identifier and the network-side counter value.
  • the transceiver module described in the eleventh aspect may include a receiving module and a sending module.
  • the receiving module is used to receive data and/or signaling from network slices and independent non-public network-specific authentication and authorization functions, access and mobility management functions, unified data management, and/or other network elements;
  • the module is used to send data and/or signaling to network slice and independent non-public network specific authentication and authorization functions, access and mobility management functions, unified data management, and/or other network elements.
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the eleventh aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the eleventh aspect can execute the method described in the fourth aspect.
  • the communication device described in the eleventh aspect may be an authentication server function, or a chip (system) or other components or components that may be configured in the authentication server function, which is not limited in this application.
  • a communication device in a twelfth aspect, includes: a processing module and a transceiver module.
  • the transceiver module is configured to send an authentication acquisition request message to the unified data management.
  • the transceiver module is also used to receive the authentication acquisition response message from the unified data management.
  • the processing module is configured to send an authentication request message to the authentication and authorization functions specific to the network slice and the independent non-public network according to the authentication indication information.
  • the transceiver module is also used for receiving authentication response messages from authentication and authorization functions specific to network slices and independent non-public networks.
  • the transceiver module is also used to send an authentication response message to the access and mobility management function.
  • the transceiver module is also used to receive the authentication result message from the access and mobility management function.
  • the transceiver module is further configured to send an authentication result confirmation request message to the unified data management.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier, and the anonymous subscription concealment identifier includes anonymous domain information, and the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication acquisition response message includes authentication indication information and an anonymous subscription permanent identifier, and the authentication indication information is used to indicate an authentication mode for authenticating the terminal device.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • Authentication methods include external authentication methods or internal authentication methods. The authentication request message is used to request authentication of the terminal device, and the authentication request message includes an anonymous subscription permanent identifier.
  • the authentication response message includes the real subscription permanent identifier and/or authentication success message, the real subscription permanent identifier includes real user name information, the real user name information is used to identify the terminal device, and the authentication success message is used to indicate that the terminal device is successfully authenticated .
  • the authentication authentication response message includes the real subscription permanent identifier and/or authentication success message.
  • the authentication authentication result message includes authentication result indication information.
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the authentication response message further includes a root key
  • the processing module is also used to generate an intermediate key according to the root key.
  • the hidden identity of the anonymous subscription further includes anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • the transceiver module described in the twelfth aspect may include a receiving module and a sending module.
  • the receiving module is used to receive data and/or signaling from network slices and independent non-public network-specific authentication and authorization functions, access and mobility management functions, unified data management, and/or other network elements;
  • the module is used to send data and/or signaling to network slice and independent non-public network specific authentication and authorization functions, access and mobility management functions, unified data management, and/or other network elements.
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the twelfth aspect can execute the method described in the fifth aspect.
  • the communication device described in the twelfth aspect may be an authentication server function, or a chip (system) or other components or components that may be configured in the authentication server function, which is not limited in this application.
  • a communication device in a thirteenth aspect, includes: a processing module and a transceiver module. Wherein, if the public key is not obtained, the processing module is used to determine the hidden identity of the anonymous contract.
  • a transceiver module configured to send a registration request message to an access and mobility management function.
  • the hidden identity of the anonymous subscription includes anonymous domain information, anonymous user name information and routing indicator, the anonymous domain information is used to indicate the identity of the network to which the authentication device that can authenticate the communication device belongs, and the anonymous user name information is the default value.
  • the registration request message includes the hidden identity of anonymous signing.
  • the processing module is further configured to execute an authentication process with an external authentication device and generate a root key.
  • the transceiver module is configured to receive a non-access stratum security mode command message from an access and mobility management function, where the non-access stratum security mode command message includes an authentication success message.
  • the processing module is further configured to generate an intermediate key according to the root key and the real subscription permanent identifier in response to the authentication success message. Wherein, the authentication success message is used to indicate that the communication device is authenticated successfully.
  • the real subscription permanent identification includes real user name information, and the real user name information is used to identify the communication device.
  • the processing module is further configured to execute an authentication process with an external authentication device and generate a root key.
  • the transceiver module is used for receiving the non-access stratum security mode command message from the access and mobility management function.
  • the processing module is further configured to generate terminal-side first verification information according to the root key, the real subscription permanent identifier, and the network-side counter value in response to the authentication success message.
  • the processing module is further configured to determine whether the first verification information on the terminal side is consistent with the first verification information on the network side. If the first verification information on the terminal side is consistent with the first verification information on the network side, the processing module is further configured to generate second verification information on the terminal side according to the root key, the real subscription permanent identifier and the counter value on the terminal side.
  • the transceiver module is also used to send the N1 message to the access and mobility management function.
  • the non-access stratum security mode command message includes an authentication success message, network-side first verification information and a network-side counter value, and the authentication success message is used to indicate that the authentication of the communication device is successful.
  • the real subscription permanent identification includes real user name information, and the real user name information is used to identify the communication device.
  • the N1 message includes the second verification information on the terminal side and the counter value on the terminal side.
  • the processing module is further configured to generate an intermediate key according to the root key, and generate first terminal-side verification information according to the intermediate key, the real contract permanent identifier, and the network-side counter value.
  • the transceiver module described in the thirteenth aspect may include a receiving module and a sending module.
  • the receiving module is used to receive data and/or signaling from the access and mobility management function and/or other network elements;
  • the sending module is used to send data to the access and mobility management function and/or other network elements and/or signaling.
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the thirteenth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the thirteenth aspect can execute the method described in the sixth aspect.
  • the communication device described in the thirteenth aspect may be a terminal device, or may be a chip (system) or other components or components that may be provided in the terminal device, which is not limited in this application.
  • a communication device in a fourteenth aspect, includes: a receiving module and a sending module.
  • the receiving module is configured to receive the registration request message from the terminal device.
  • the sending module is also used to send the authentication request message to the authentication server function.
  • the receiving module is also used for receiving the authentication response message from the authentication server function.
  • the sending module is further configured to send an authentication result message to the authentication server function when the terminal device successfully executes the non-access stratum security mode command process.
  • the registration request message includes an anonymous subscription hidden identifier
  • the anonymous signed hidden identifier includes anonymous domain information, anonymous user name information, and a routing indicator
  • the anonymous domain information is used to indicate the identity of the network to which the authentication device capable of authenticating the terminal device belongs.
  • ID anonymous username information is the default.
  • the authentication request message includes the hidden identity of the anonymous contract.
  • the authentication authentication response message includes a real subscription permanent identifier and/or an authentication success message, the real subscription permanent identifier includes real user name information, the real user name information is used to identify the terminal device, and the authentication success message is used to indicate that the terminal device is authenticated. right to success.
  • the authentication and authentication result message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the receiving module and the sending module can be set separately, or can be integrated into one module, that is, the transceiver module. This application does not specifically limit the specific implementation manners of the receiving module and the sending module.
  • the communication device may further include a processing module and a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the fourteenth aspect can execute the method described in the seventh aspect.
  • the communication device described in the fourteenth aspect may be an access and mobility management function, or a chip (system) or other components or components that can be configured for the access and mobility management function. There is no limit to this.
  • a communication device in a fifteenth aspect, includes: a processing module and a transceiver module.
  • the transceiver module is used for receiving the authentication request message from the authentication server function.
  • the transceiver module is also used to receive the protocol response message from the external authentication device.
  • the processing module is used to judge whether the anonymous domain information matches the real domain information, and if the real domain information matches the anonymous domain information, the sending and receiving module is also used to send an authentication response message to the authentication server function.
  • the authentication request message may include an anonymous subscription permanent identifier.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • the protocol response message may include the real subscription permanent identifier, and may also include an authentication success message, and/or a root key.
  • the authentication response message may include authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the hidden identity of the anonymous subscription further includes anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • the transceiver module described in the fifteenth aspect may include a receiving module and a sending module.
  • the receiving module is used to receive data and/or signaling from the authentication server function, external authentication device and/or other network elements;
  • the sending module is used to send the authentication server function, external authentication device and/or other network elements to send data and/or signaling.
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the fifteenth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the fifteenth aspect can execute the method described in the eighth aspect.
  • the communication device described in the fifteenth aspect may be a network slice and an independent non-public network-specific authentication and authorization function, or may be configured in a network slice and an independent non-public network-specific authentication and authorization function.
  • Functional chips (systems) or other components or components are not limited in this application.
  • a communication device in a sixteenth aspect, includes: a processor, the processor is coupled with a memory, and the memory is used for storing computer programs.
  • the processor is configured to execute the computer program stored in the memory, so that the communication method described in any possible implementation manner of the second aspect to the eighth aspect is executed.
  • the communication device may further include a transceiver.
  • the transceiver can be a transceiver circuit or an input/output port.
  • the transceiver may be used by the communication means to communicate with other devices.
  • the input port can be used to realize the receiving function involved in the second aspect to the eighth aspect
  • the output port can be used to realize the sending function involved in the second aspect to the eighth aspect.
  • the communication device described in the sixteenth aspect may be an access and mobility management function, an authentication server function, unified data management, network slicing, and an independent non-public network-specific authentication and authorization function or a terminal device , or set in access and mobility management functions, authentication server functions, unified data management, network slicing and independent non-public network-specific authentication and authorization functions or chips or chip systems inside terminal devices.
  • a chip system in a seventeenth aspect, includes a logic circuit and an input/output port.
  • the logic circuit is used to realize the processing function involved in the second aspect to the eighth aspect
  • the input/output port is used to realize the sending and receiving function involved in the second aspect to the eighth aspect.
  • the input port can be used to realize the receiving function involved in the second aspect to the eighth aspect
  • the output port can be used to realize the sending function involved in the second aspect to the eighth aspect.
  • the chip system further includes a memory, which is used to store program instructions and data for realizing the functions involved in the second aspect to the eighth aspect.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • a computer-readable storage medium including: a computer program or instruction; when the computer program or instruction is run on a computer, the The communication method described above is executed.
  • a computer program product including computer programs or instructions.
  • the communication described in any one of the possible implementations from the second aspect to the eighth aspect is provided. method is executed.
  • FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of the architecture of a SPNN network provided by an embodiment of the present application.
  • Fig. 3 is a kind of NAS SMC flowchart diagram that the embodiment of the present application provides
  • FIG. 4 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • the technical solutions of the embodiments of the present application can be applied to various communication systems, such as universal mobile telecommunications system (universal mobile telecommunications system, UMTS), wireless local area network (wireless local area network, WLAN), wireless fidelity (wireless fidelity, Wi-Fi ) system, wired network, vehicle to everything (V2X) communication system, device-to-device (D2D) communication system, vehicle networking communication system, 4th generation (4th generation, 4G) mobile communication Systems, such as long term evolution (LTE) system, worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5th generation, 5G) mobile communication system, such as new radio , NR) system, and future communication systems, such as the sixth generation (6th generation, 6G) mobile communication system, etc.
  • Universal mobile telecommunications system Universal mobile telecommunications system, UMTS
  • wireless local area network wireless local area network
  • WLAN wireless local area network
  • wireless fidelity wireless fidelity
  • Wi-Fi wireless fidelity
  • wired network wired
  • the present application presents various aspects, embodiments or features in terms of a system that can include a number of devices, components, modules and the like. It is to be understood and appreciated that the various systems may include additional devices, components, modules, etc. and/or may not include all of the devices, components, modules etc. discussed in connection with the figures. In addition, combinations of these schemes can also be used.
  • a subscript such as W1 may be a clerical error into a non-subscript form such as W 1 .
  • the network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.
  • FIG. 1 is a schematic structural diagram of a communication system to which the communication method provided in the embodiment of the present application is applicable.
  • the communication system includes terminal equipment and core network elements.
  • the number of network elements of the core network may be one or more.
  • the communication system may also include an external authentication device. There can be one or more external authentication devices. When there are multiple external authentication devices, the networks to which each external authentication device belongs are also different.
  • the above-mentioned terminal device is a terminal that accesses the above-mentioned communication system and has a wireless transceiver function, or a chip or a chip system that can be set on the terminal.
  • the terminal equipment may also be called user equipment (user equipment, UE), user device, access terminal, subscriber unit, subscriber station, mobile station, mobile station (mobile station, MS), remote station, remote terminal, mobile device, A user terminal, terminal, terminal unit, end station, terminal device, wireless communication device, user agent or user device.
  • the terminal device in the embodiment of the present application may be a mobile phone, a wireless data card, a personal digital assistant (personal digital assistant, PDA) computer, a laptop computer, a tablet computer (Pad), Unmanned aerial vehicle, computer with wireless transceiver function, machine type communication (machine type communication, MTC) terminal, virtual reality (virtual reality, VR) terminal equipment, augmented reality (augmented reality, AR) terminal equipment, Internet of things (internet of things) things, IoT) terminal equipment, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical, wireless terminals in smart grid Terminals, wireless terminals in transportation safety, wireless terminals in smart city, wireless terminals in smart home (such as game consoles, smart TVs, smart speakers, smart refrigerators and fitness equipment etc.), vehicle-mounted terminals, and RSUs with terminal functions.
  • MTC machine type communication
  • VR virtual reality
  • AR augmented reality
  • IoT Internet of things
  • An access terminal can be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA) , a handheld device (handset) with wireless communication function, a computing device or other processing device connected to a wireless modem, a wearable device, and the like.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • Handset handheld device with wireless communication function
  • computing device or other processing device connected to a wireless modem a wearable device, and the like.
  • the terminal device in the embodiment of the present application can be an express terminal in smart logistics (such as a device that can monitor the location of cargo vehicles, a device that can monitor the temperature and humidity of goods, etc.), a wireless terminal in smart agriculture (such as a device that can collect poultry wearable devices related to livestock data, etc.), wireless terminals in smart buildings (such as smart elevators, fire monitoring equipment, and smart meters, etc.), wireless terminals in smart medical care (such as wireless terminals that can monitor the physiological status of people or animals) Wearable devices), wireless terminals in smart transportation (such as smart buses, smart vehicles, shared bicycles, charging pile monitoring equipment, smart traffic lights, and smart monitoring and smart parking equipment, etc.), wireless terminals in smart retail (such as automatic vending Cargo planes, self-checkout machines, and unmanned convenience stores, etc.).
  • smart logistics such as a device that can monitor the location of cargo vehicles, a device that can monitor the temperature and humidity of goods, etc.
  • a wireless terminal in smart agriculture such as a device that can collect poultry wearable devices
  • the terminal device of the present application may be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip, or a vehicle-mounted unit built into a vehicle as one or more components or units. Groups, on-board components, on-board chips, or on-board units can implement the methods provided in this application.
  • the communication system shown in FIG. 1 may be applicable to the communication network currently being discussed, or to other networks in the future, which is not specifically limited in this embodiment of the present application.
  • the communication system shown in Figure 1 is applied to an independent non-public network (stand-alone non-public network, SNPN) network as an example, as shown in Figure 2, the SNPN network may include terminal equipment, core network elements, AAA server, (wireless) access network ((radio) access network, (R) AN) equipment, and data network (data network, DN).
  • SNPN stand-alone non-public network
  • the SNPN network may include terminal equipment, core network elements, AAA server, (wireless) access network ((radio) access network, (R) AN) equipment, and data network (data network, DN).
  • the terminal device may store long-term keys and related functions.
  • core network elements such as AMF network elements, AUSF network elements, etc.
  • it can use long-term keys and related functions to verify the authenticity of the network.
  • core network elements may include but not limited to one or more of the following: user plane function (user plane function, UPF) network element, access and mobility management function (core access and mobility management function, AMF)/security Anchor function (security anchor function, SEAF) network element, session management function (session management function, SMF) network element, authentication server function (authentication server function, AUSF) network element, network slice selection function (network slice selection function, NSSF) ) network element, network exposure function (network exposure function, NEF) network element, network function storage function (network exposure function Repository Function, NRF), policy control function (policy control function, PCF) network element, unified data management (unified data management (UDM) network elements, application function (application function, AF) network elements, and network slice-specific and independent non-public network-specific authentication and authorization function (network slice-specific and SNPN authentication and authorization function, NSSAAF) network elements.
  • user plane function user plane function
  • UPF access and mobility management function
  • AMF access and mobility management function
  • AMF authentication
  • the terminal device accesses the 5G network through the RAN device, and the terminal device communicates with the AMF through the N1 interface (N1 for short); the RAN device can communicate with the AMF through the N2 interface (N2 for short); the RAN device can communicate with the AMF through the N3 interface (N3 for short).
  • the UPF communicates; the SMF communicates with the UPF through the N4 interface (N4 for short), and the UPF accesses the data network through the N6 interface (N6 for short).
  • control plane functions such as AUSF, AMF/SEAF, SMF, NSSF, NEF, NRF, PCF, UDM, NSSAAF or AF shown in Figure 2 use service-oriented interfaces for interaction.
  • the service interface provided by AUSF is Nausf, AMF and SEAF can be jointly established
  • the service interface provided by AMF is Namf
  • the service interface provided by SMF is Nsmf
  • the service interface provided by NSSF is Nnssf
  • NEF The service interface provided externally is Nnef
  • the service interface provided by NRF is Nnrf
  • the service interface provided by PCF is Npcf
  • the service interface provided by UDM is Nudm
  • the service interface provided by NSSAAF is Nnssaaf, AF
  • the service interface provided externally is Naf.
  • the AMF network element is mainly responsible for signaling processing, such as access control, mobility management, attachment and detachment, and gateway selection.
  • the AMF network element provides services for the session in the terminal device, it can provide the session with storage resources on the control plane to store the session ID, the SMF network element ID associated with the session ID, and the like.
  • AMF can also obtain 5G NAS security context, which is used to protect NAS messages.
  • the SMF network element is responsible for user plane network element selection, user plane network element redirection, Internet protocol (internet protocol, IP) address allocation, bearer establishment, modification and release, and quality of service (quality of service, QoS) control, etc.
  • Internet protocol Internet protocol, IP
  • the UPF network element is responsible for forwarding and receiving user data in terminal equipment.
  • the UPF network element can receive user data from the data network and transmit it to the terminal device through the RAN device; the UPF network element can also receive user data from the terminal device through the RAN device and forward it to the data network.
  • the transmission resources and scheduling functions that provide services for terminal equipment in the UPF network element are managed and controlled by the SMF network element.
  • the AUSF network elements can support 3GPP and non-3GPP access authentication.
  • the NSSF network element is mainly responsible for the selection of network slices. It can determine the network slice instance that the terminal device is allowed to access according to the slice selection auxiliary information and subscription information of the terminal device, which can be used for the network to verify whether the UE is real. In the internal authentication scenario, the AUSF network element can authenticate the terminal device.
  • the NEF network element mainly supports the secure interaction between the 3GPP network and third-party applications.
  • NRF network elements can support registration and discovery of network functions.
  • the PCF network element is responsible for decision-making of policy control, and can provide policy rules for control plane functions and flow-based charging control functions.
  • the UDM network element is mainly responsible for the contract data management of the terminal equipment, including the storage and management of the terminal equipment identification, the access authorization of the terminal equipment, etc.
  • the AF network element mainly supports interaction with the 3GPP core network to provide services, such as influencing data routing decisions, policy control functions, or providing some third-party services to the network side.
  • the main function of the NSSAAF network element is to connect with the external AAA server, and to convert the service based interface (SBI) interface to the AAA interface. It is an intermediate network element connecting the internal network element of the 3GPP network and the external AAA server.
  • the NSAAF is pre-configured with the correspondence between the address information of the AAA server and the domain information. After receiving the domain information, the NSAAF can determine the AAA server based on the address information of the AAA server, and then send the received message to the AAA server.
  • NSSAAF can request the address information of the AAA server from the domain name server (domain name server, DNS) server according to the domain information, and obtain the address information of the AAA server from the DNS server, and then send the received message to the AAA server.
  • domain name server domain name server, DNS
  • the external authentication device shown in Figure 1 above can be the AAA server shown in Figure 2, and the external authentication device can be called an AAA server, or an authentication server, etc., and the external authentication device can store user credentials, credentials It can be used to authenticate the identity of the terminal device.
  • the external authentication device can be used to process the access request of the terminal device, provide verification authorization and account service, manage users' access to the network server, and provide services to the terminal device with access rights.
  • the above-mentioned access network device is a device located on the network side of the above-mentioned communication system and has a wireless transceiver function, or a chip or a chip system that can be provided in the device.
  • the access network equipment includes but is not limited to: an access point (access point, AP) in a wireless fidelity (wireless fidelity, Wi-Fi) system, such as a home gateway, a router, a server, a switch, a network bridge, etc., an evolved Node B (evolved Node B, eNB), radio network controller (radio network controller, RNC), node B (Node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved NodeB, or home Node B, HNB), baseband unit (baseband unit, BBU), wireless relay node, wireless backhaul node, transmission point (transmission and reception point, TRP or transmission point,
  • the communication method provided by the embodiment of the present application can be applied between any two nodes shown in Figure 1 and Figure 2, such as between a terminal device and a core network element, or between multiple core network elements Between, and between the network element of the core network and the AAA server, the specific implementation may refer to the following method embodiments, which will not be repeated here.
  • FIG. 1 is only a simplified schematic diagram for easy understanding, and the communication system may also include other network devices and/or other terminal devices, which are not shown in FIG. 1 .
  • subscription concealed identifier (SUCI)
  • subscription permanent identifier (SUPI)
  • This application includes two types of SUCI: real subscription hidden identification (may be referred to as real SUCI for short) and anonymous subscription hidden identification (may be referred to as anonymous SUCI for short), and includes two types of SUPI: real subscription permanent identification (may be referred to as real SUPI for short) and anonymous Subscribe Permanent Identifier (may be referred to as anonymous SUPI for short).
  • the hidden identity of the real subscription may be called the hidden identity of the real subscriber, or the hidden identity of the non-anonymized subscriber
  • the hidden identity of the anonymous subscription may be called the hidden identity of the anonymous subscriber.
  • the real The permanent sign-up ID is called the permanent ID of the real subscriber, or the permanent ID of the non-anonymized subscriber, etc.
  • the permanent ID of the anonymous subscription is called the permanent ID of the anonymous subscriber, etc. This application does not limit the related names.
  • the real SUCI may be generated by the terminal device after encrypting and integrity-protecting the real SUPI according to a pre-configured public key.
  • the terminal device can use a null-scheme to generate a real SUCI.
  • the format of the SUCI may include a network access identifier (network access identifier, NAI) format, and an international mobile subscriber identity (international mobile subscriber identity, IMSI) format.
  • NAI network access identifier
  • IMSI international mobile subscriber identity
  • the format of SUPI may include formats such as NAI format and IMSI format.
  • the format of the corresponding SUCI may be the IMSI format or the NAI format, which is related to specific application scenarios. If the format of the SUPI is not the IMSI format, the format of the corresponding SUCI may be the NAI format.
  • real SUCI may include username information and domain information.
  • Real SUPI may include username information and domain information.
  • the anonymous SUCI may only include domain information, and optionally, may also include user name information.
  • the anonymous SUPI may only include domain information, and optionally, may also include username information.
  • the domain information included in its real SUCI, real SUPI, anonymous SUPI and anonymous SUCI is the same, and their username information is generally different (different formats and/or information representation have different meanings).
  • both the real SUCI and the user name information included in the real SUPI can identify the terminal device, but their formats may be different (for details, please refer to TS23.003 28.7.2 and 28.7.3), for example, the user in the real SUCI
  • the name information can be obtained by mapping the user name information in the real SUPI.
  • the username information in anonymous SUCI and real SUCI/real SUPI is generally different. For the relationship between anonymous SUCI and anonymous SUPI, refer to the description of the following embodiments of this application.
  • anonymous domain information refers to domain information carried in anonymous SUPI or anonymous SUCI.
  • Real domain information refers to domain information carried in real SUPI or real SUCI.
  • Anonymous user information refers to user information carried in anonymous SUPI or anonymous SUCI.
  • Real user information refers to user information carried in real SUPI or real SUCI.
  • the username information of the anonymous SUCI may include one or more of the following: routing indicator (routing indicator, RID), function information and default value.
  • routing indicator routing indicator
  • RID routing indicator
  • function information may be a default value or not.
  • the domain information may include the home network information of the user, which may be used by relevant network elements/functional entities to determine the network where the subscription data corresponding to the user name information is located.
  • the domain information indicates the identity of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the real user name information can be used to identify the terminal device, for example, to indicate the unique identity of the terminal device.
  • the anonymous user name information can be used to pass some necessary information, or to ensure that the anonymous SUCI/anonymous SUPI has the same format as the real SUCI/real SUCI, so that the network side can parse the anonymous SUCI/anonymous SUPI.
  • the network side can determine whether a SUCI is an anonymous SUCI or a real SUCI according to the user name information in the SUCI.
  • the username (username information) part may include one or more of the following: RID information, function information, and default values.
  • the AMF network element can determine the AUSF network element according to the RID information, and the AUSF network element can determine the UDM network element according to the RID information.
  • the AMF network element or the AUSF network element requests the AUSF network element or the UDM network element from the NRF network element, and the NRF network element returns the AUSF network element or the UDM network element corresponding to the RID information of the default value. .
  • the function information may indicate a usage scenario of the anonymous SUCI, and/or indicate whether it is a real SUCI or an anonymous SUCI.
  • it is applied to a scenario where an external authentication device authenticates a terminal device, or is applied to an SNPN network, and the like.
  • an anonymous SUCI may be in the format: SNPN@realm, or external@realm, or ANY@realm, or anonymous@realm.
  • Anonymous anonymous, ANY is used to indicate that the SUCI is an anonymous SUCI.
  • the default value can be used to supplement the relevant bits representing the real identity.
  • the real SUCI username is composed of type ⁇ supi type>.rid ⁇ routing indicator>.schid ⁇ protection scheme id>.userid ⁇ MSIN or Network Specific Identifier SUPI username>, then the default value is used to fill the userid part.
  • the real SUPI in NAI format may be 234150999999999@wlan.mnc015.mcc234.3gppnetwork.org, where wlan.mnc015.mcc234.3gppnetwork.org is the user's hometown network information.
  • the anonymous SUCI may not include user name information, and the anonymous SUCI is domain information (realm), and may also include a domain information part and an @ symbol, such as @realm.
  • the anonymous SUCI can be @wlan.mnc015.mcc234.3gppnetwork.org or wlan.mnc015.mcc234.3gppnetwork.org (that is, the @ symbol is not included).
  • the anonymized SUCI can specifically be a SUCI composed of only the realm part of the real SUCI after using the empty mechanism to generate the real SUCI.
  • the anonymous SUCI may also include anonymous user name information, which may be set as a default value.
  • the anonymous SUCI can be 000000000000000@wlan.mnc015.mcc234.3gppnetwork.org (that is, the user name information part is all filled with the default value 0 of the same amount of bits, and can also be filled with other agreed default values currently).
  • the information (RID information, function information and/or default value) constituting the anonymous SUCI may be combined with each other, and when they are combined, a connector may or may not be used.
  • the anonymous SUCI can be SNPNRID@realm, etc.
  • the anonymous SUCI can be RID@realm.
  • the anonymous SUCI can be SNPN@realm.
  • the connector is ".”
  • the anonymous SUCI can be SNPN.RID@realm. This application does not enumerate them one by one.
  • the username information included in the anonymous SUPI may include one or more of the following: RID information, function information, counter value and default value.
  • RID information may be a default value or not.
  • an anonymous SUPI in NAI format could be RID@realm.
  • the function information may indicate the usage scenario of the anonymous SUPI, and/or indicate whether the SUPI is a real SUPI or an anonymous SUPI, such as being applied to a scenario where an external authentication device authenticates a terminal device, or applied to a SNPN network, and the like.
  • the anonymous SUPI in NAI format can be SNPN@realm, or external @realm, or ANY@realm, or anonymous @realm, etc. ANY is used to indicate that the SUPI is an anonymous SUPI.
  • the counter value may be a value of the counter, and the counter value may be an integer greater than or equal to 0, and the anonymous SUPI may be identified using the counter value.
  • a counter can be maintained for all home networks, so that different anonymous SUPIs can be assigned to different home networks; or, a counter can be maintained for each home network, which can achieve finer granularity, only need to ensure the same home network
  • the uniqueness of the anonymous SUPI does not limit the size or length of the counter value.
  • the counter can be composed of 32 bits, and finally can output an integer or a 32-bit binary number. The counter has an initial value of 0 and increments by 1 each time it is used.
  • the anonymous SUPI can be 0@realm#1, 1@realm#2, 3@realm#1, where realm#1 and realm#2 represent 2 different home networks.
  • 3 counter values means that an anonymous SUPI with a counter value of 0 is allocated to the network of realm#1 first, then an anonymous SUPI with a counter value of 1 is allocated to the network of realm#2, and finally a counter is allocated to the network of realm#1 Anonymous SUPI with value 3.
  • the anonymous SUPI can be 0@realm#1, 0@realm#2, 1@realm#1, where realm#1 and realm#2 represent 2 different hometowns network, these 3 counter values represent that an anonymous SUPI with a counter value of 0 is first allocated to the network of realm#1, and an anonymous SUPI with a counter value of 0 is allocated to the network of realm#2, and finally the network of realm#1 An anonymous SUPI with a counter value of 1 is assigned.
  • the username information of the anonymous SUPI may be a default value.
  • the default value can be used to supplement the relevant bits representing the real identity.
  • anonymous SUPI in NAI format can be username@realm.
  • the username part is the default value.
  • the default value can be 0, then the format of anonymized SUPI at this time is 0@realm, or 00000000@realm.
  • 00000000 means username consists of 8 numbers. This application example does not limit the number of 0s.
  • the information (RID information, function information, counter value and/or default value) constituting the anonymous SUPI may be combined with each other, and when they are combined, a connector may or may not be used.
  • the anonymous SUPI can be SNPNRID@realm, 1RID@realm, 2SNPN@realm, etc.
  • the anonymous SUPI can be RID@realm.
  • the anonymous SUPI can be SNPN@realm.
  • the anonymous SUPI can be SNPN.RID@realm, SNPN.RID.1@realm, SNPN.1.RID@realm, SNPN.2@realm, ANY.1@relam, SNPN.ANY.1@realm. This application does not enumerate them one by one.
  • the authentication mode refers to a mode in which the authentication device authenticates the terminal device.
  • the authentication method may include an external authentication method or an internal authentication method.
  • Authentication devices can be classified into external authentication devices and internal authentication devices.
  • the external authentication method may refer to a method of authenticating the terminal device through an external authentication device.
  • the external authentication device and the AUSF network element providing network services for the terminal device belong to different networks, such as an AAA server.
  • the internal authentication mode may refer to a mode in which the terminal device is authenticated by an internal authentication device.
  • the internal authentication device and the terminal device belong to the same network, such as an AUSF network element.
  • the authentication success message may be used to indicate that the authentication of the terminal device is successful.
  • the external authentication device After the external authentication device successfully authenticates the terminal device, it generates an authentication success message and sends it to AUSF through NSSAAF, such as an extensible authentication protocol (EAP) success (success) message.
  • EAP extensible authentication protocol
  • the authentication result indication information is used to indicate the success or failure of the terminal device authentication, for example, when the network side considers the terminal device to be real (for example, the real contract permanent).
  • the identifier is the same as the real subscription permanent identifier on the terminal device side, for another example, the AUSF determines according to the authentication success message, for another example, the AUSF authenticates the terminal device successfully), and the AUSF generates authentication result indication information.
  • the authentication result indication information is generated by the AUSF and sent to the UDM.
  • the format or presentation form of the authentication result indication information is different from that of the authentication success message.
  • the authentication result indication information may be in an information format that can be recognized by the UDM, for example, "1" is used to indicate that the authentication is successful.
  • the first verification information on the network side, the second verification information on the network side, the first verification information on the terminal side, and the second verification information on the terminal side :
  • the "network side” in the first verification information on the network side, the second verification information on the network side, the first verification information on the terminal side, and the second verification information on the terminal side refers to the network element (such as AUSF) on the network side. "Refers to be determined by the terminal equipment, and words such as “first” and “second” do not limit the number and execution order.
  • the first verification information on the network side and the second verification information on the network side are verification information determined by the AUSF.
  • the terminal-side first verification information and the terminal-side second verification information are verification information determined by a terminal device.
  • the terminal device judges whether the first verification information on the network side is consistent with the first verification information on the terminal side to determine whether the network side is authentic. If they are the same, the terminal device considers the network side to be authentic.
  • the AUSF judges whether the second verification information on the terminal side is consistent with the second verification information on the network side to determine whether the terminal device is authentic, and if so, the AUSF considers the terminal device to be authentic. In this way, the two-way authentication between the terminal device and the network side can be completed.
  • the terminal device can determine whether the network side is authentic by receiving the authentication success message. If the authentication success message is received, the terminal device believes that the network side is authentic, and the authentication success message indicates that the terminal device is successfully authenticated. right.
  • the steps of AUSF generating the first verification information on the network side and the terminal device generating the first verification information on the terminal side and comparing whether they are consistent may not be executed. Combining with the AUSF to determine whether the second verification information on the terminal side is consistent with the second verification information on the network side, the two-way authentication between the terminal device and the network side can be completed.
  • This application proposes a scheme for mutual authentication between a terminal device and a network side.
  • mapping refers to that the domain information parts are completely the same, or there is a mapping relationship between the domain information parts.
  • the domain information part of the anonymous SUPI is FQDN#1
  • the domain information part of the real SUPI is FQDN#2. If FQDN#1 is mapped or associated with or identical to FQDN#2, it is considered that FQDN#1 matches FQDN#2, so the Anonymous SUPI is the same as real SUPI.
  • mutual authentication between the terminal device and the network side is implemented by judging whether the verification information on the terminal side is the same as that on the network side.
  • the verification information on the terminal side is determined according to the real SUPI and key
  • the verification information on the network side is determined according to the real SUPI and key corresponding to the credential used in the authentication process on the network side. If the information is the same as the verification information on the network side, it means that the real SUPI corresponding to the credential used in the authentication process on the network side is the same as the real SUPI of the terminal. In this way, the two-way authentication between the terminal device and the network side can be completed, and the terminal device believes that the network Authentic, the network considers the end device to be authentic.
  • non-access stratum non-access stratum
  • SMC security mode command
  • the key Kamf may be generated according to the key Kseaf, and the parameters FC, P0, L0, L1, etc. are used as the input of a key derivation function (key derivation function, KDF), and the length of Kseaf may be 256 bits.
  • KDF key derivation function
  • the key Kseaf may be generated according to the key Kausf.
  • FC 0x6D
  • P0 IMSI or NAI or GCI or GLI
  • L0 represents the length of P0
  • L1 represents the length of P1.
  • P0 represents the value of the real SUPI
  • the value of SUPI is used as an input parameter to participate in the generation of the key Kamf.
  • SUPI type of SUPI + value of SUPI.
  • the values of SUPI include IMSI, NAI, GCI and GLI.
  • the types of SUPI include IMSI type and NSI type. The meaning displayed in P0 is to use only the value of SUPI, not including the type of SUPI.
  • Fig. 3 is a schematic flow diagram of a NAS SMC provided by the embodiment of the present application.
  • the communication method includes the following steps:
  • the AMF network element enables integrity protection.
  • the AMF network element sends a NAS SMC message to the terminal device.
  • the terminal device receives the NAS SMC message from the AMF network element.
  • the NAS SMC message may include: a key identifier (such as a 5G key identifier (key set identifier in 5G, 5G ngKSI)), and/or information elements such as capability information of the terminal device.
  • a key identifier such as a 5G key identifier (key set identifier in 5G, 5G ngKSI)
  • information elements such as capability information of the terminal device.
  • the NAS SMC message indicates that the key corresponding to the key identifier is used for security protection.
  • the AMF network element enables uplink decryption protection.
  • the AMF network element enables downlink encryption protection.
  • the terminal device performs NAS SMC integrity protection verification.
  • the terminal device sends a NAS security mode complete (security mode complete, SMP) message to the AMF network element.
  • the AMF network element receives the NA SMP message from the terminal equipment.
  • NAS SMC procedures can be used to activate keys.
  • the NAS SMC process can occur after the main authentication process (see S409 below).
  • the AMF network element and the terminal device can generate a new key Kausf (for example, generated in S705 below), and the value of SUPI in SUPI participates in the generation of the key Kamf.
  • a key Kseaf is generated according to the key Kausf
  • a key Kamf is further generated according to the key Kseaf
  • a new NAS key for example, an integrity protection key KNASint, an encryption protection key KNASenc
  • New NAS keys are activated through the NAS SMC process.
  • the AMF network element verifies the integrity of the NAS SMP message and successfully decrypts the NAS SMP message, it determines that the NAS SMC process is successfully executed with the terminal device.
  • the NAS SMC process can be successfully completed. It can be concluded that because the NAS SMC process is successful, the terminal device and the AMF network element have the same real SUPI, the real SUPI on the AMF network element side is received from the AUSF network element (see S703 below), so the real SUPI on the terminal device side is the same as the real SUPI on the AUSF network element side.
  • the AMF network element may generate a key identifier ngKSI (for example, generated in S704 below).
  • the AMF network element can carry the ngKSI in the NAS SMC message of the NAS SMC process.
  • the NAS SMC process is not necessarily executed after the main authentication process, which means that although the new key Kausf is generated in the main authentication process, the new key Kausf will not be activated because the NAS SMC process is not executed. The key Kausf will not use a new key. At this time, the terminal device and the AMF network element continue to use the currently used key.
  • the currently used key is not necessarily the key generated in the previous main authentication process, because the NAS SMC process may not be executed after the previous main authentication process.
  • the currently used key is not directly related to whether to execute the main authentication process, but is related to whether to execute the NAS SMC process, and is related to the key identifier carried in the NAS SMC message.
  • Figures 4 to 7 take AUSF, AMF, UDM, and NSSAAF shown in Figure 2 as examples.
  • the communication method provided by this application can also be applied to other and future network architectures, and the corresponding names can also be Replace it with the names of corresponding functions in other network architectures and various forms of network architectures in the future.
  • FIG. 4 is a schematic flowchart of a communication method provided in an embodiment of the present application.
  • the communication method includes the following steps:
  • the AUSF sends an authentication acquisition request message to the UDM.
  • the UDM receives the authentication acquisition request message from the AUSF.
  • the authentication acquisition request message may include an anonymous subscription concealment identifier.
  • the hidden identifier of the anonymous subscription includes anonymous domain information, and the anonymous domain information may be used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the hidden identity of the anonymous subscription may also include anonymous user name information and a routing indicator, where the anonymous user name information is a default value.
  • the specific implementation method of hiding the identity of the anonymous contract can refer to the above description of the anonymous SUCI, and will not be repeated here.
  • the AUSF may send an authentication acquisition request message to the UDM according to the RID information.
  • the communication method provided in the embodiment of the present application may further include: S405, if the public key is not obtained, the terminal device determines the hidden identity of the anonymous subscription.
  • the hidden identity of the anonymous subscription is determined by the terminal device.
  • the terminal device determines whether the RID information stored on its universal subscriber identity module (universal subscriber identity module, USIM) or mobile equipment (mobile equipment, ME) is the default value, and if so, the generated anonymous subscription hides the identity
  • the RID information may not be included, if not, the generated anonymous contract hidden identifier carries the RID information, such as RID@realm.
  • the AMF or AUSF requests the AUSF or UDM from the NRF, and the NRF returns the AUSF or UDM corresponding to the default value of the RID information.
  • the RID information is set for selecting AUSF or UDM.
  • the RID information can be preset in the USIM card or the terminal device, and can also be sent to the terminal device by the UDM through the air protocol (over the air, OTA) or other processes.
  • the SNPN network can preset different RID information for different terminal devices. For example, RID#1 is provided for the terminal device whose credential is stored in the UDM of the SNPN network, and RID#2 is provided for the terminal device using external authentication, that is, an external authentication device. At this time, the external information is stored in the authentication peer device The final credential used for authentication.
  • the AUSF and UDM that can be selected by RID#1 and RID#2 are different. Specifically, AUSF#1 and UDM#1 can be selected according to RID#1, and AUSF#2 and UDM#2 can be selected according to RID#2. AUSF#1 and AUSF#2 may be two different instances, or two different functional entities. The same applies to UDM#1 and UDM#2. In this way, the network elements used internally and externally can be safely isolated, preventing the same AUSF and/or UDM from serving internally and externally. The same AUSF and/or UDM serves both internal and external services, which may face the risk of increasing the attack surface.
  • an attacker can construct an anonymous SUCI at will, continuously initiate the authentication process, and occupy AUSF resources. Eventually, the resources of the AUSF may be exhausted, and the AUSF cannot serve internally or externally. In the case of security isolation, the attacker will not affect the resources of the AUSF serving internally, so the SNPN network can still serve internal users well.
  • the communication method provided in the embodiment of the present application may further include: S406, the terminal device sends a registration request message to the AMF.
  • the AMF receives the registration request message from the terminal device.
  • AMF may be AMF/SEAF.
  • This application takes AMF as an example for illustration.
  • the registration request message may include an anonymous subscription concealment identifier.
  • the Registration Request message may be used to request a registration procedure to the SNPN network.
  • the communication method provided in the embodiment of the present application may further include: S407, the AMF sends an authentication request message to the AUSF.
  • the AMF receives the authentication request message from the AUSF.
  • the authentication request message may include an anonymous subscription concealment identifier.
  • the hidden identity of the anonymous subscription may be sent by the terminal device to the AUSF via the AMF.
  • the authentication request message may also include a service network (serving network, SN) name (name).
  • SN serving network
  • the SN name indicates the network where the AMF is located, and the UDM can use the SN name as an input parameter when authenticating the terminal device.
  • the AMF may send an authentication request message to the AUSF according to the RID information.
  • the UDM determines an authentication mode for authenticating the terminal device according to the anonymous domain information and the configuration information.
  • the UDM and the AUSF may be the same network element, and the functions of the UDM and the AUSF may be performed by the same network element, for example, both are performed by the AUSF, or both are performed by the NSSAAF. Alternatively, in the case where the UDM is not deployed in the network, this function is performed by the AUSF. This application does not limit it, and in this case, the step of interaction between UDM and AUSF can be omitted.
  • the authentication mode may include an external authentication mode or an internal authentication mode.
  • the anonymous domain information may be used to indicate the identity of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the anonymous domain information includes multiple domain names, it means that the SNPN network supports interaction with multiple authentication devices in different networks to authenticate the terminal device.
  • the configuration information may include identities of one or more networks corresponding to the external authentication mode, and/or identities of one or more networks corresponding to the internal authentication mode.
  • the configuration information may include domain names of one or more networks corresponding to the external authentication mode, and/or domain names of one or more networks corresponding to the internal authentication mode.
  • the format of the domain name may be a fully qualified domain name (fully qualified domain name, FQDN), which is not limited in this application.
  • the format of the pre-embedded information in the configuration information may be the same as that of the realm in the anonymous SUCI.
  • the configuration information may also include authentication indication information, and the authentication indication information corresponds to the identifier of the network.
  • each network identifier corresponds to one piece of authentication indication information.
  • identifiers of multiple networks correspond to one authentication instruction information, for example, identifiers of some networks correspond to authentication instruction information indicating an external authentication method, and identifiers of another part of networks correspond to authentication instruction information indicating an internal authentication method.
  • the configuration information may be stored in the subscription data of the terminal device, or in the subscription data of the network corresponding to the network identifier (such as a domain name), or stored separately in the UDM to serve all anonymous SUCI or anonymous SUPI .
  • configuration information can be pre-configured on UDM.
  • the authentication indication information may be used to indicate the authentication mode.
  • the authentication indication information when the authentication indication information indicates that the authentication mode is internal authentication, the authentication indication information may indicate the authentication method, and the authentication indication information may also carry parameters required for authentication, such as the Certificate.
  • the authentication method is used to indicate a specific authentication method.
  • the authentication method may include an extensible authentication protocol-transport level security (EAP-TLS) authentication method, and an EAP tunneled transport layer security (EAP-tunneled transport layer security, EAP-TTLS) Authentication method.
  • EAP-TLS extensible authentication protocol-transport level security
  • EAP-TTLS EAP tunneled transport layer security
  • the above S402 may include the following step 1 and/or step 2.
  • Step 1 and Step 2 can be used alone or in combination. Step 1 can be executed first, and then Step 2 can be executed, or Step 2 can be executed first, and then Step 1 can be executed.
  • the order of Step 1 and Step 2 is not limited.
  • Step 1 When the identity of the network to which the authentication device that can authenticate the terminal device belongs matches the identity of one or more networks corresponding to the external authentication method, determine the authentication method for authenticating the terminal device It is an external authentication method; or, in the case where the identification of the network to which the device authentication device belongs matches the identification of one or more networks corresponding to the internal authentication method, it is determined that the terminal device
  • the authentication method for authentication is the internal authentication method.
  • matching refers to that the identifiers of the networks are the same, or there is a mapping relationship between the identifiers of the networks.
  • the network identifier #1 of the configuration information storage may be the network name #1, and the anonymous domain information in the anonymous SUCI includes the network name 1 and other information, then it can be considered that the network identifier #1 of the configuration information storage is related to the anonymous domain information match.
  • the network name #1 can be understood as the identifier of the network to which the authentication device belongs.
  • the network identifier #1 stored in the configuration information may be a network identifier #1, and the network identifier may be a character string representing the name of an external network.
  • the configuration information includes network name #1 and other information, then UDM can determine whether the one-way or two-way mapping between network name #1 and network identifier #1 is possible, for example, whether the network identifier can be obtained from network name #1 #1, if it can be obtained, it can be considered that the network name #1 matches the network identifier #1.
  • the network identifier #1 can be understood as the identifier of the network to which the authentication device belongs.
  • the configuration information includes: network ID 1, network ID 2, and network ID 3 corresponding to external authentication methods, network ID 4, network ID 5, and network ID 6 corresponding to internal authentication methods, if the anonymous domain information includes network If the identifier is 1, it is determined that the authentication method for authenticating the terminal device is an external authentication method; if the anonymous domain information includes the network identifier 5, it is determined that the authentication method for authenticating the terminal device is an internal authentication method.
  • step 2 the UDM determines whether the identity of the network indicated by the anonymous domain information is the same as the identity of the network to which the UDM belongs.
  • the authentication mode for authenticating the terminal device is an internal authentication mode.
  • step 1 For the combination of step 1 and step 2, take step 1 first and then step 2 as an example.
  • UDM executes step 1. If the authentication method (such as internal authentication or external authentication) can be determined, step 2 may not be performed; if the authentication method cannot be determined (such as the network does not match the identifiers of one or more networks in the configuration information), then perform step 2, if step 2 is yes, then determine that the authentication method is internal authentication, and the authentication method can be further determined. It should be noted that after step 1 is used to determine the authentication mode, step 2 can still be performed, which is not limited in this application.
  • the authentication method such as internal authentication or external authentication
  • UDM terminates the authentication process.
  • the UDM may not process the message or send a failure message to the AUSF, for example the failure message may indicate registration failure.
  • Terminating the authentication process means that the anonymized SUCI has no right to access the network.
  • step 2 first and then step 1 is similar to the above-mentioned example of performing step 1 first and then step 2. You can refer to the example of performing step 1 first and then step 2, which will not be described in detail here.
  • Step 1 is first performed, and the UDM determines whether the identity of the network indicated by the anonymous domain information is the same as the identity of the network to which the UDM belongs. If yes, it is determined that the authentication mode for authenticating the terminal device is an internal authentication mode. For example, if the identity of the network to which the device authentication device belongs matches the identity of one or more networks corresponding to the internal authentication mode, determine the authentication method for authenticating the terminal device. The method is the internal authentication method. If not, perform step 2 again: in the case where the identity of the network to which the authentication device that can authenticate the terminal device belongs matches the identity of one or more networks corresponding to the external authentication mode, determine to authenticate the terminal device. The authentication mode of the authentication is an external authentication mode.
  • the UDM may determine a manner of authenticating the terminal device according to the subscription concealment identifier. For example, in the case that the hidden subscription identifier received by the UDM is anonymous, the UDM determines to use an external authentication method to authenticate the terminal device. In the case that the hidden subscription identifier received by the UDM is true, the UDM determines to use an internal authentication method to authenticate the terminal device.
  • the UDM sends an authentication acquisition response message to the AUSF.
  • the AUSF receives the authentication acquisition response message from the UDM.
  • the authentication acquisition response message may include authentication indication information for indicating whether the authentication mode is internal authentication or external authentication.
  • authentication indication information for indicating whether the authentication mode is internal authentication or external authentication.
  • UDM can send specific authentication methods to AUSF, such as authentication through external authentication methods, or authentication through internal authentication methods, and can also send certificate information used for authentication, etc., or can also send A specific authentication method, such as an EAP-TLS authentication method, an EAP-TTLS authentication method, and the like.
  • AUSF can obtain the authentication method, and can further obtain the specific authentication method and/or parameters required for authentication.
  • the authentication acquisition response message may also include an anonymous subscription permanent identifier.
  • the permanent identifier of the anonymous subscription may be determined by the UDM according to the hidden identifier of the anonymous subscription, and the permanent identifier of the anonymous subscription may include anonymous domain information.
  • the embodiment of the present application does not limit the order in which the UDM determines the anonymous subscription permanent identity and the UDM determines the authentication indication information.
  • the authentication indication information can be determined first, and then the anonymous subscription permanent identifier can be determined when the authentication indication information indicates that the authentication mode for authenticating the terminal device is an external authentication mode.
  • the anonymous subscription permanent identifier may be determined first, and then the authentication indication information may be determined.
  • the authentication indication information is determined according to the subscription data corresponding to the anonymous subscription permanent identifier.
  • the subscription data corresponding to the anonymous subscription permanent identifier may be the subscription data at the granularity of the network to which the external authentication device belongs. That is, to have all anonymous subscription permanent identities of the network use the same subscription data at this moment.
  • the domain information of the permanent identification of anonymous signing is the same as the domain information of the hidden identification of anonymous signing, for example, both are anonymous domain information.
  • the anonymous subscription permanent identifier may also include anonymous user name information, and the anonymous user name information includes one or more of the following: RID information, function information, counter value, and default value.
  • the RID information may be the same as the RID information of the hidden identifier of the anonymous contract.
  • the first function information may be used to indicate a usage scenario of the anonymous subscription permanent identifier.
  • anonymous subscription permanent identifier can refer to the above-mentioned description of the anonymous SUPI, and will not be repeated here.
  • the AUSF sends an authentication request message to the NSSAAF according to the authentication indication information.
  • NSSAAF receives the authentication request message from AUSF.
  • the authentication request message may be used to request authentication of the terminal device.
  • an authentication request message is sent to the NSSAAF, triggering the NSSAAF to request the first device to authenticate the terminal device; when the authentication indication information indicates that the authentication When the method is internal authentication, an authentication request message is sent to the AMF to instruct the AMF to perform internal authentication on the terminal device.
  • the authentication request message may include an anonymous subscription permanent identification. Therefore, the external authentication device can authenticate the terminal device through the anonymous subscription permanent identifier.
  • the above S404 may include the following steps 3 and 4.
  • Step 3 when the authentication indication information indicates that the authentication mode is external authentication, the AUSF sends an authentication request message to the NSSAAF.
  • Step 4 when the authentication indication information indicates that the authentication mode is internal authentication, the AUSF sends an authentication request message to the AMF.
  • step 1 and “step 2" in this application do not indicate the sequence of execution.
  • the communication method provided in the embodiment of the present application may further include: S408, the NSSAAF sends a protocol request message to the external authentication device.
  • the external authentication device receives the protocol request message from NSSAAF.
  • the protocol request message may include the anonymous subscription permanent identifier, or include the anonymous domain information and not include information other than the anonymous domain information in the anonymous subscription permanent identifier.
  • the NSSAAF may select an external authentication device from one or more external authentication devices according to the anonymous domain information of the anonymous subscription permanent identifier, and send a protocol request message to the external authentication device.
  • the anonymous domain information indicates the identifier of the network to which the authentication device that can authenticate the terminal device belongs, for example, the anonymous domain information indicates the network identifier 4, then NSSAAF selects an external authentication device of the network corresponding to the network identifier 4 , and send a protocol request message to it, requesting to authenticate the terminal device.
  • the communication method provided in the embodiment of the present application may further include: S409, the external authentication device performs an authentication process with the terminal device, or the AUSF performs an authentication process on the terminal device.
  • S409 is a process of authenticating the terminal device, which is not specifically described in this application.
  • the terminal device performs an authentication process with an external authentication server, and generates a root key (master key, MSK).
  • a root key master key, MSK
  • the UDM receives the anonymous subscription hidden identifier including the anonymous domain information, the anonymous domain information is used to indicate the identifier of the network to which the authentication device that can authenticate the terminal device belongs, according to the anonymous domain information and
  • the configuration information determines the authentication indication information, and the authentication indication information is used to indicate the authentication mode.
  • the configuration information includes one or more network identities corresponding to the external authentication mode, and/or one or more network identifications corresponding to the internal authentication mode. In this way, the method of authenticating the terminal device can be successfully determined.
  • FIG. 5 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 5 can be used in combination with FIG. 4, and the communication method shown in FIG. 5 can be executed after the authentication between the external authentication device and the terminal device is successful in step S409.
  • the communication method includes the following steps:
  • the NSSAAF sends an authentication response message to the AUSF.
  • AUSF receives the authentication response message from NSSAAF.
  • the authentication response message may include a real subscription permanent identifier, an authentication success message and/or a root key MSK.
  • the real subscription permanent identifier is the identity information corresponding to the credential used in the authentication process by the external authentication device.
  • the real subscription permanent identifier may include real domain information and real user name information.
  • the real subscription permanent identifier refer to the above-mentioned implementation of the real SUPI, which will not be described in detail here.
  • the real domain information may be used to indicate the domain name of the network to which the credential used by the external authentication device in the authentication process belongs.
  • the real user name information is used to identify the terminal device.
  • the real user name information may be used to indicate the unique identity of the terminal device.
  • the external authentication device uses the real subscription permanent identifier to authenticate the terminal device, and considers that the real subscription permanent identifier is the real SUPI of the terminal device.
  • the authentication success message may be used to indicate that the authentication of the terminal device is successful. For example, it indicates that the authentication in the above S409 is successful.
  • the root key MSK is a key generated during the authentication process of the external authentication device and the terminal device, and its application method will be different due to different authentication methods, and the embodiment of the present application does not limit its generation method.
  • the communication method provided in the embodiment of the present application may further include: S512, the external authentication device sends a protocol response message to the NSSAAF.
  • NSSAAF receives the protocol response message from the external authentication device.
  • the protocol response message may include the real subscription permanent identifier, and may also include an authentication success message, and/or a root key MSK.
  • the real subscription permanent identity, the authentication success message, and/or the root key MSK may be sent to the AUSF by the external authentication device through the NSSAAF.
  • the AUSF In response to the authentication success message, the AUSF generates first network-side verification information according to the root key, the real subscription permanent identifier, and the network-side counter value.
  • the above S502 may include the following steps 5 to 6.
  • Step five AUSF generates an intermediate key Kausf according to the root key.
  • Step 6 AUSF generates the first verification information on the network side according to the intermediate key Kausf and the real contract permanent identifier.
  • the AUSF may determine the first network-side verification information according to at least two of the intermediate key Kausf, function information, real subscription permanent identifier, and network-side counter value.
  • the function information is used to indicate the usage scenario of the real subscription permanent identity, for example, it is applied to the SNPN network, SUPI authentication (authentication) and so on.
  • Capability information can be a string.
  • the network-side counter value is an integer greater than or equal to 0, and the initial value of the network-side counter value may be 0.
  • the AUSF may maintain a counter locally, and the value of the counter on the network side is the value currently stored in the counter maintained by the AUSF locally. Every time the first verification information on the network side is calculated, the value of the counter is increased by 1.
  • the network side counter value may be a random number.
  • the determined first verification information on the network side may be calculated through the following formula (1).
  • SNPN_MACI_AUSF KDF(Kausf_1, the first input parameter, the second input parameter) (1)
  • the first input parameter is the real subscription permanent identifier.
  • the second input parameter is optional, and the second input parameter may be one or more input parameters.
  • the second input parameter is function information and/or network-side counter value.
  • SNPN_MACI_AUSF is the first verification information on the network side, for example, a MAC value, indicating the MAC value calculated by AUSF in the SPNN network scenario.
  • Kausf_1 is the intermediate key Kausf.
  • KDF() stands for key derivation function (key derivation function, KDF).
  • the AUSF sends an authentication authentication response message to the AMF.
  • the AMF receives the authentication response message from the AUSF.
  • the authentication response message may include the first verification information on the network side, an authentication success message, a counter value on the network side, and/or an intermediate key Kseaf.
  • the AUSF may send the network-side first verification information, the authentication success message and/or the network
  • the side counter value is sent to the AMF to be sent to the terminal equipment through the AMF.
  • the intermediate key Kseaf may be generated by AUSF.
  • the AUSF may generate an intermediate key Kausf according to the root key, and generate an intermediate key Kseaf according to the intermediate key Kausf.
  • the AMF sends a NAS SMC message to the terminal device.
  • the terminal device receives the NAS SMC message from the AMF.
  • the NAS SMC message may include network-side first verification information, an authentication success message, and/or a network-side counter value.
  • the terminal device judges whether the first verification information on the terminal side is consistent with the first verification information on the network side.
  • the terminal device determines that the real subscription permanent identifier is the same as the real subscription permanent identifier, and the identity information corresponding to the credential used by the external authentication device in the authentication process
  • the identity information corresponding to the credential on the terminal device side is the same, the terminal device determines that the AUSF is real, otherwise, the real signing permanent ID is different from the real signing permanent ID, the terminal device determines that the AUSF is false, and the external authentication device is authenticating
  • the real SUPI used in the process is not the real SUPI of the terminal device. Wherein, whether the AUSF is real or false is equivalent to that the terminal device thinks that the accessed network is real or false.
  • the communication method provided by the embodiment of the present application may further include: the terminal device responds to the authentication success message, and generates the first terminal-side authentication method according to the root key, the real subscription permanent identifier and the network-side counter value. information.
  • the above-mentioned terminal device generates the first terminal-side verification information according to the root key, the real subscription permanent identifier and the network-side counter value, which may include the following steps 7 to 8.
  • step seven the terminal device generates an intermediate key Kausf according to the root key.
  • the root key may be generated by the terminal device in the above authentication process in S409.
  • Step 8 The terminal device generates first terminal-side verification information according to the intermediate key Kausf, the real subscription permanent identifier and the network-side counter value.
  • the terminal-side first verification information may be determined by the terminal device according to at least two of the intermediate key, function information, real subscription permanent identifier, and network-side counter value.
  • the intermediate key Kausf may be generated according to the root key MSK.
  • the function information is used to indicate the usage scenario of the real subscription permanent identity, for example, it is applied to the SNPN network, SUPI authentication (authentication) and so on.
  • Capability information can be a string.
  • the real subscription permanent identifier may include real domain information and real username information, and the real username information is used to identify the terminal device.
  • the real subscription permanent identifier refer to the above-mentioned implementation of the real SUPI, which will not be described in detail here.
  • the determined first terminal-side verification information can be calculated by formula (1), where the terminal-side first verification information is represented by XSNPN_MACI_AUSF, which can be a MAC value, indicating the expected MAC value of the terminal device in the SNPN network scenario.
  • the first input parameter is the real subscription permanent identifier.
  • the communication method shown in FIG. 5 may include the above S502 to S505.
  • the AUSF may send the first verification information on the network side and the counter value on the network side to the terminal device through the AMF, and the terminal device may determine whether the first verification information on the network side is the same as the first verification information on the terminal side.
  • the communication method shown in FIG. 5 may include the above S503 to S504.
  • the AUSF can send an authentication success message to the terminal device through the AMF, and the terminal device can obtain the authenticity of the AUSF according to the authentication success message, and continue to execute the following S506.
  • the steps of the AUSF generating the first verification information on the network side and the terminal device generating the first verification information on the terminal side and comparing whether they are consistent may not be executed.
  • the terminal device can determine whether the AUSF is authentic through the first verification information on the network side and the first verification information on the terminal side, or can determine whether the AUSF is authentic by whether the authentication is successful. If the authentication is successful, the AUSF is real, if the authentication fails, AUSF is not real.
  • the terminal device AMF sends an N1 message.
  • the AMF receives the N1 message from the terminal device.
  • the N1 message may include the second terminal-side verification information and/or the terminal-side counter value.
  • the communication method provided in the embodiment of the present application may further include: the terminal device generates second verification information on the terminal side according to the root key, the real subscription permanent identifier, and the terminal-side counter value.
  • the counter value on the terminal side may not be equal to the counter value on the network side that generates the first verification information on the terminal side.
  • the terminal device when the first verification information on the terminal side is consistent with the first verification information on the network side, the terminal device generates second verification information on the terminal side according to the root key and the real subscription permanent identifier. The corresponding terminal device determines whether the AUSF is authentic through the first verification information on the network side and the first verification information on the terminal side.
  • the terminal device when receiving the authentication success message, the terminal device generates the second terminal-side verification information according to the root key, the real subscription permanent identifier, and the terminal-side counter value. The corresponding terminal device determines whether the AUSF is authentic based on whether the authentication is successful.
  • the above-mentioned terminal device generates the second verification information on the terminal side according to the root key, the real subscription permanent identifier and the terminal side counter value, which may include: the terminal device generates the intermediate key Kausf according to the root key, and generates the intermediate key Kausf according to the intermediate key Kausf, the real subscription permanent identifier and the counter value on the terminal side generate the second verification information on the terminal side.
  • the second verification information on the terminal side may be determined by the terminal device according to at least two of the intermediate key, function information, real subscription permanent identifier, and terminal-side counter value.
  • the terminal-side counter value is an integer greater than or equal to 0, and the initial value of the terminal-side counter value may be 0.
  • the terminal device may maintain a counter locally, and the terminal side counter value is the value currently stored in the counter locally maintained by the terminal device, and the value of the counter is incremented by 1 every time the second verification information on the terminal side is calculated.
  • the counter value at the terminal side may be a random number.
  • the determined second verification information at the terminal side may be calculated through formula (1).
  • the second verification information on the terminal side may be represented by SNPN_MACI_UE, which may be a MAC value, and SNPN_MACI_UE represents a MAC value calculated by the terminal device in an SNPN network scenario.
  • the first input parameter is the real subscription permanent identifier.
  • the function information may include an acknowledgment or response to receiving the first verification information from the network side.
  • the AMF sends an authentication authentication intermediate message to the AUSF.
  • the AUSF receives the authentication authentication intermediate message from the AMF.
  • the authentication authentication intermediate message may include the second verification information on the terminal side and/or the counter value on the terminal side.
  • the AUSF judges whether the second verification information on the terminal side is consistent with the second verification information on the network side.
  • the AUSF determines that the real subscription permanent identifier is the same as the real subscription permanent identifier, and the identity information corresponding to the credential used by the external authentication device in the authentication process is the same as If the identity information corresponding to the credential on the terminal device side is the same, AUSF determines that the terminal device is authentic; otherwise, the real signing permanent identifier is different from the real signing permanent identifier, and AUSF determines that the terminal device is false.
  • the communication method provided by the embodiment of the present application may further include: AUSF generating second verification information on the network side according to the root key, the real subscription permanent identifier and the counter value on the terminal side.
  • the above-mentioned AUSF generating the second verification information on the network side according to the root key, the real subscription permanent identifier and the terminal side counter value may include: AUSF generating the intermediate key Kausf according to the root key, and generating the intermediate key Kausf according to the intermediate key Kausf, the real Subscribe to the permanent identifier and the counter value on the terminal side to generate second verification information on the network side.
  • the second verification information on the network side may be determined by the AUSF according to at least two of the intermediate key Kausf, function information, real subscription permanent identifier, and terminal-side counter value.
  • the second verification information on the network side may be calculated by formula (1).
  • the second verification information on the network side may be represented by XSNPN_MACI_UE, and XSNPN_MACI_UE represents the MAC value expected by the AUSF in the SNPN network scenario.
  • the first input parameter is the real subscription permanent identifier.
  • the function information may include an acknowledgment or response to receiving the first verification information from the network side.
  • the two-way authentication between the terminal device and the network side can be completed, the terminal device believes that the network is real, and the network believes that the terminal device is real.
  • the AUSF when the second verification information on the terminal side is consistent with the second verification information on the network side, the AUSF sends an authentication result confirmation request message to the UDM.
  • the UDM receives the authentication result confirmation request message from the AUSF.
  • the request message for confirmation of the authentication result may include the real permanent identifier of the subscription, the indication information of the authentication result, and/or the permanent identifier of the anonymous subscription.
  • the authentication result indication information indicates that the terminal device has successfully authenticated, and the authentication result indication information is used to indicate that the main authentication process is successful.
  • the UDM will record the successful authentication of the terminal device according to the indication information.
  • the UDM saves the real subscription permanent identifier and authentication result indication information.
  • the UDM may save the real permanent identifier of the subscription, the indication information of the authentication result, and/or the permanent identifier of the anonymous subscription.
  • the UDM after the UDM generates the permanent anonymous subscription ID (refer to S403 above), it can create an entry for the anonymous subscription permanent ID to record whether its subsequent authentication succeeds. Therefore, after the UDM receives the real subscription permanent identifier, it can directly store the real subscription permanent identifier into this entry, or replace the anonymous subscription permanent identifier with the real subscription permanent identifier, directly store the real subscription permanent identifier into this entry and Anonymous signing permanent identification deletion.
  • the UDM does not create an entry for the permanent identifier of the anonymous subscription.
  • the UDM After receiving the authentication result confirmation request message, the UDM creates an entry, which may include the real permanent identifier of the subscription, and optionally, may also include the permanent identifier of the anonymous subscription.
  • the UDM may request the subscription data corresponding to the anonymous subscription permanent identifier from the external network for use by the network where the UDM is located, or the UDM may use the public subscription data of the external network as the subscription data corresponding to the anonymous subscription permanent identifier.
  • the UDM sends an authentication result confirmation response message to the AUSF.
  • the AUSF receives the authentication result confirmation response message from the UDM.
  • FIG. 6 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 6 can be used in combination with FIG. 4, and the communication method shown in FIG. 6 can be executed after the authentication between the external authentication device and the terminal device is successful in step S409.
  • the communication method includes the following steps:
  • the NSSAAF sends an authentication response message to the AUSF.
  • AUSF receives the authentication response message from NSSAAF.
  • the communication method provided in the embodiment of the present application may further include: S610, the external authentication device sends a protocol response message to the NSSAAF.
  • NSSAAF receives the protocol response message from the external authentication device.
  • the AUSF judges whether the anonymous domain information matches the real domain information.
  • the anonymous domain information is the domain information in the permanent identity of the anonymous subscription
  • the real domain information is the domain information in the permanent identity of the real subscription.
  • AUSF can To determine whether the real subscription permanent identity used for authentication and the terminal device belong to the same network. In this way, it can be avoided that the real subscription permanent ID authenticated by the external authentication device does not belong to the network corresponding to the anonymous subscription permanent ID.
  • the real domain information and the anonymous domain information of the real subscription permanent identifier used for authentication are of the same network.
  • the real signed permanent identification can be saved. If the anonymous domain information does not match the real domain information, the real subscription permanent identifier and the terminal device do not belong to the same network, and the external authentication device fails to authenticate the terminal device.
  • the anonymous domain information may be obtained from the anonymous subscription permanent identifier, and the anonymous subscription permanent identifier may be received through the authentication acquisition response message in S403 above.
  • the real domain information may be obtained from the real subscription permanent identifier, or the authentication response message includes the real domain information.
  • the action of judging whether the anonymous domain information matches the real domain information may be performed by the NSSAAF (for example, an NSSAAF network element).
  • the NSSAAF judges whether the anonymous domain information matches the real domain information.
  • the specific implementation manner of S603 is similar to that of S602 above, and it only needs to replace AUSF with NSSAAF.
  • NSSAAF can send the result of whether the anonymous domain information matches the real domain information to AUSF, for example, through an authentication response message.
  • the authentication response message can include authentication result indication information, and the authentication result indication information indicates that the terminal device is authenticated right to success.
  • the AUSF sends an authentication result confirmation request message to the UDM.
  • the UDM receives the authentication result confirmation request message from the AUSF.
  • the UDM saves the real subscription permanent identifier and authentication result indication information.
  • the UDM sends an authentication result confirmation response message to the AUSF.
  • the AUSF receives the authentication result confirmation response message from the UDM.
  • the AUSF generates an intermediate key Kausf according to the root key and the real signed permanent identifier.
  • step S602 the AUSF may only use the user identity information part in the real subscription permanent identification to generate the intermediate key Kausf.
  • the user identity information in the real subscription permanent ID can be part of username or IMSI.
  • the embodiment of this application is not limited. If step S602 is not executed, the real subscription is permanently identified as the value of SUPI. That includes username and realm.
  • the intermediate key Kausf can be used for key derivation.
  • deduce Kseaf deduce Kseaf.
  • the AUSF may determine the intermediate key Kausf according to the real signing permanent identity and the root key, and use the first key Kausf as the root key to derive the key Kseaf.
  • the AUSF sends an authentication response message to the AMF.
  • the AMF receives the authentication response message from the AUSF.
  • the authentication response message may include one or more of the following: an authentication success message, a real subscription permanent identifier, and/or an intermediate key Kseaf.
  • the AMF sends the NAS SMC message to the terminal device.
  • the terminal device receives the NAS SMC message from the AMF.
  • the NAS SMC message may include one or more of the following: authentication success message.
  • the AUSF determines whether the real subscription permanent identifier used in the authentication process of the external authentication device is the same as the real subscription permanent identifier on the terminal device side according to the anonymous domain information and the real domain information, if If they are the same, the two-way authentication between the terminal device and the network side can be completed, the terminal device believes that the network is real, and the network believes that the terminal device is real.
  • FIG. 7 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 7 can be used in combination with FIG. 4, and the communication method shown in FIG. 7 can be executed after the authentication between the external authentication device and the terminal device is successful in step S409.
  • the communication method includes the following steps:
  • the NSSAAF sends an authentication response message to the AUSF.
  • AUSF receives the authentication response message from NSSAAF.
  • the communication method provided in the embodiment of the present application may further include: S712, the external authentication device sends a protocol response message to the NSSAAF.
  • NSSAAF receives the protocol response message from the external authentication device.
  • the AUSF generates an intermediate key Kausf according to the root key.
  • the AUSF may determine the intermediate key Kausf with the root key, and use the intermediate key Kausf as the root key to deduce the intermediate key Kseaf.
  • the method for determining the intermediate key Kausf in S702 is different from the method for determining the intermediate key Kausf in S604.
  • the intermediate key Kausf is determined according to the real signing permanent ID and the root key.
  • the AUSF sends an authentication authentication response message to the AMF.
  • the AMF receives the authentication response message from the AUSF.
  • the authentication response message may include one or more of the following: an authentication success message, an intermediate key Kseaf, and/or a real subscription permanent identifier.
  • the AMF sends the NAS SMC message to the terminal device.
  • the terminal device receives the NAS SMC message from the AMF.
  • the NAS SMC message may include one or more of the following: authentication success message.
  • the authentication success message is used to indicate that the terminal device is authenticated successfully.
  • the terminal device In response to the authentication success message, the terminal device generates an intermediate key Kausf according to the root key, and generates an intermediate key Kseaf according to the intermediate key Kausf.
  • the terminal device and the AMF perform a NAS SMC process.
  • the terminal device and the AMF use the intermediate key Kseaf, the side real signing permanent identifier, the real signing permanent identifier, and the intermediate key Kseaf to execute the NAS SMC process.
  • the AMF sends an authentication result message to the AUSF.
  • the AUSF receives the authentication result message from the AMF.
  • the authentication authentication result message may include authentication result indication information, and the authentication result indication information includes information indicating successful authentication of the terminal device, for example, it may indicate that the real subscriber permanent ID is the same as the real subscriber permanent ID.
  • the authentication result message itself may inform the AUSF that the NAS SMC process interacted with the terminal device is successful.
  • the NAS SMC process is successful, and it can be concluded that the real subscription permanent identifier used for authentication is the same as the real subscription permanent identifier of the terminal device.
  • the two-way authentication between the terminal device and the network side can be completed, the terminal device believes that the network is real, and the network believes that the terminal device is real.
  • the authentication result indication information may be used to indicate that the real subscription permanent identifier used in the authentication process by the external authentication device is the same as the real subscription permanent identifier on the terminal device side.
  • the AUSF sends an authentication result response message to the AMF.
  • the AMF receives the authentication result response message from the AUSF.
  • the AUSF sends an authentication result confirmation request message to the UDM.
  • the UDM receives the authentication result confirmation request message from the AUSF.
  • the UDM saves the real subscription permanent identifier and authentication result indication information.
  • the UDM sends an authentication result confirmation response message to the AUSF.
  • the AUSF receives the authentication result confirmation response message from the UDM.
  • the above S709 to S711 can be executed after the above S701, or the above S709 to S711 can be executed after the above S708, so as to allow the UDM to record when the authentication of the real SUPI is successful, so as to avoid the In the case of authentication failure, it is necessary to notify the UDM to delete the additional signaling overhead of the authentication record. This application does not limit this.
  • the NAS SMC process is executed after the authentication process. If the NAS SMC process is successful, it can be concluded that the real subscription permanent identifier used for authentication is the same as the real subscription permanent identifier of the terminal device, so that the external authentication
  • the identity information corresponding to the credential used in the authentication process of the device is the same as the identity information corresponding to the credential on the terminal device side. In this way, the two-way authentication between the terminal device and the network side can be completed, the terminal device believes that the network is real, and the network believes that the terminal device is real.
  • FIG. 8 is a schematic structural diagram of a communication device that can be used to implement the communication method provided by the embodiment of the present application.
  • the communication device 800 may be an access and mobility management function, or an authentication server function, or a unified data management, or a network slice and an independent non-public network-specific authentication and authorization function, or a terminal device, or an external authentication device, It can also be applied to access and mobility management functions, or authentication server functions, or unified data management, or network slicing and independent non-public network-specific authentication and authorization functions, or terminal devices, or external authentication devices chips or other components with corresponding functions.
  • a communication device 800 may include a processor 801 .
  • the communications device 800 may further include one or more of a memory 802 and a transceiver 803 .
  • the processor 801 may be coupled with one or more of the memory 802 and the transceiver 803, such as through a communication bus, or the processor 801 may be used alone.
  • the components of the communication device 800 are specifically introduced below in conjunction with FIG. 8 :
  • the processor 801 is the control center of the communication device 800, and may be one processor, or may be a general term for multiple processing elements.
  • the processor 801 is one or more central processing units (central processing unit, CPU), may also be a specific integrated circuit (application specific integrated circuit, ASIC), or is configured to implement one or more An integrated circuit, for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • An integrated circuit for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • the processor 801 can execute various functions of the communication device 800 by running or executing software programs stored in the memory 802, and calling data stored in the memory 802.
  • the processor 801 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 8 .
  • the communication device 800 may also include multiple processors, for example, the processor 801 and the processor 804 shown in FIG. 8 .
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more communication devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the memory 802 may be a read-only memory (read-only memory, ROM) or other types of static storage communication devices that can store static information and instructions, or a random access memory (random access memory, RAM) that can store information and other types of dynamic storage communication devices for instructions, and can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or Other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disc storage media or other magnetic storage communication devices, or can be used to carry or store desired information in the form of instructions or data structures program code and any other medium that can be accessed by a computer, but not limited to.
  • the memory 802 can be integrated with the processor 801 or exist independently, and is coupled with the processor 801 through an input/output port (not shown in FIG. 8 ) of the communication device 800 , which is not specifically limited in this embodiment of the present application.
  • the input port can be used to implement access and mobility management functions, or authentication server functions, or unified data management, or network slicing and independent non-public network-specific authentication and authorization functions in any of the above method embodiments , or a receiving function performed by a terminal device, or an external authentication device
  • the output port can be used to implement the access and mobility management function, or the authentication server function, or unified data management, or network slicing in any of the above method embodiments and separate non-public network-specific authentication and authorization functions, or transmission functions performed by terminal devices, or external authentication devices.
  • the memory 802 can be used to store a software program for executing the solution of the present application, and the execution is controlled by the processor 801 .
  • the processor 801 controls the execution of the solution of the present application.
  • the transceiver 803 is used for communication with other communication devices.
  • the transceiver 803 may be used to communicate with the authentication server function and/or other network elements.
  • the transceiver 803 may be used for authentication and authorization functions, access and mobility management functions, unified data management, and/or or other network element communications.
  • the transceiver 803 may be used to communicate with access and mobility management functions and/or other network elements.
  • the transceiver 803 may be used to communicate with terminal equipment, an authentication server function, and/or other network elements.
  • the transceiver 803 may be used for communicating with an authentication server function, an external authentication device and/or other network elements.
  • the transceiver 803 may be used to communicate with the authentication server function, the external authentication device and/or other network elements.
  • the transceiver 803 may include a receiver and a transmitter (not separately shown in FIG. 8 ).
  • the transceiver 803 may be integrated with the processor 801, or may exist independently, and be coupled to the processor 801 through an input/output port (not shown in FIG. 8 ) of the communication device 800, which is not specifically limited in this embodiment of the present application. .
  • the structure of the communication device 800 shown in FIG. 8 does not constitute a limitation to the communication device, and an actual communication device may include more or less components than shown in the figure, or combine certain components, or Different component arrangements.
  • unified data management in FIGS. 1-7 can be executed by the processor 801 in the communication device 800 shown in FIG. 8 calling the application program code stored in the memory 802 to instruct unified data management. limit.
  • the above-mentioned actions of the authentication server function in FIGS. 1-7 can be executed by the processor 801 in the communication device 800 shown in FIG. 8 calling the application program code stored in the memory 802 to instruct the authentication server function. No restrictions are imposed.
  • the above-mentioned actions of the terminal device in FIGS. 1-7 can be executed by the processor 801 in the communication device 800 shown in FIG. 8 calling the application program code stored in the memory 802 to instruct the terminal device to execute, which is not limited in this embodiment.
  • FIGS. 1-7 The actions of the above-mentioned access and mobility management functions in FIGS. 1-7 can be executed by the processor 801 in the communication device 800 shown in FIG. 8 calling the application program code stored in the memory 802 to instruct the access and mobility management functions , which is not limited in this embodiment.
  • the above-mentioned actions of the external authentication device in FIGS. 1-7 can be executed by the processor 801 in the communication device 800 shown in FIG. 8 calling the application program code stored in the memory 802 to instruct the external authentication device to execute. No restrictions are imposed.
  • the communication device 800 can perform the access and mobility management function, or the authentication server function, or the unified data management, or the network slicing and independent non-public network-specific authentication and authorization functions, or the terminal equipment, in the above method embodiments, Or any one or more possible design methods involved in external authentication equipment.
  • FIG. 9 is a schematic structural diagram of another communication device provided by an embodiment of the present application. For ease of illustration, FIG. 9 only shows the main components of the communication device.
  • the communication device 900 includes a transceiver module 901 and a processing module 902 .
  • the communication device 900 may be the authentication server function in the foregoing method embodiments, or unified data management, or network slicing and independent non-public network-specific authentication and authorization functions, or terminal equipment, or external authentication equipment.
  • the transceiver module 901 which can also be referred to as a transceiver unit, is used to implement the authentication server function, or unified data management, or network slicing and independent non-public network-specific authentication and authorization functions, or terminal in any of the above method embodiments The sending and receiving function performed by the device, or an external authentication device.
  • the transceiver module 901 may include a receiving module and a sending module (not shown in FIG. 9 ). Wherein, the receiving module is used for receiving data and/or signaling from other devices; the sending module is used for sending data and/or signaling to other devices. This application does not specifically limit the specific implementation manner of the transceiver module.
  • the transceiver module may be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the processing module 902 can be used to implement authentication server functions, or unified data management, or network slicing and independent non-public network-specific authentication and authorization functions, or terminal devices, or external authentication in any of the above method embodiments
  • the processing function performed by the device may be a processor.
  • the communication device 900 is presented in the form of dividing various functional modules in an integrated manner.
  • a “module” here may refer to a specific ASIC, a circuit, a processor and a memory executing one or more software or firmware programs, an integrated logic circuit, and/or other devices that can provide the functions described above.
  • the communication device 900 can take the form of the communication device 800 shown in FIG. 8 .
  • the processor 801 in the communication device 800 shown in FIG. 8 may invoke the computer-executed instructions stored in the memory 802, so that the communication method in the above method embodiment is executed.
  • the functions/implementation process of the transceiver module 901 and the processing module 902 in FIG. 9 can be implemented by the processor 801 in the communication device 800 shown in FIG. 8 invoking computer-executed instructions stored in the memory 802 .
  • the function/implementation process of the processing module 902 in FIG. 9 can be realized by the processor 801 in the communication device 800 shown in FIG. /The implementation process can be implemented by the transceiver 803 in the communication device 800 shown in FIG. 8 .
  • the communication device 900 provided in this embodiment can execute the above-mentioned communication method, the technical effect it can obtain can refer to the above-mentioned method embodiment, and details are not repeated here.
  • FIG. 10 is a schematic structural diagram of another communication device provided by an embodiment of the present application. For ease of illustration, FIG. 10 only shows the main components of the communication device.
  • the communication device 1000 includes a sending module 1001 and a receiving module 1002 .
  • the communication device 1000 may be the access and mobility management function in the foregoing method embodiments.
  • the sending module 1001 which may also be referred to as a sending unit, is configured to implement the sending function performed by the access and mobility management function in any of the above method embodiments.
  • the sending module 1001 and the receiving module 1002 can be set separately, or can be integrated into one module, that is, a transceiver module.
  • the transceiver module may be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the communication device 1000 may further include a processing module 1003 and a storage module, where programs or instructions are stored in the storage module.
  • the processing module 1003 executes the program or instruction
  • the communication device 1000 can execute the method described in any one of the foregoing method embodiments.
  • the processing module 1003 may be configured to implement the processing function performed by the access and mobility management function in any of the foregoing method embodiments.
  • the processing module 1003 may be a processor.
  • the communication device 1000 is presented in the form of dividing various functional modules in an integrated manner.
  • a “module” here may refer to a specific ASIC, a circuit, a processor and a memory executing one or more software or firmware programs, an integrated logic circuit, and/or other devices that can provide the functions described above.
  • the communication device 1000 can take the form of the communication device 800 shown in FIG. 8 .
  • the processor 801 in the communication device 800 shown in FIG. 8 may invoke the computer-executed instructions stored in the memory 802, so that the communication method in the above method embodiment is executed.
  • the functions/implementation process of the processing module and the storage module in FIG. 10 may be implemented by the transceiver 803 in the communication device 800 shown in FIG. 8 .
  • the function/implementation process of the processing module in FIG. 10 can be implemented by the processor 801 in the communication device 800 shown in FIG. 8 calling the computer-executed instructions stored in the memory 802,
  • the communication device 1000 provided in this embodiment can execute the above-mentioned communication method, the technical effect it can obtain can refer to the above-mentioned method embodiment, and details are not repeated here.
  • the communication device 900 shown in FIG. 9 can be applied to the communication system shown in FIG. 1 and FIG. 2, and implement unified data management in the communication methods shown in FIGS. 4-7 function.
  • the transceiver module 901 is configured to receive an authentication acquisition request message from an authentication server function.
  • the processing module 902 is configured to determine an authentication mode for authenticating the terminal device according to the anonymous domain information and configuration information.
  • the transceiver module 901 is further configured to send an authentication acquisition response message to the authentication server function.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier
  • the anonymous subscription concealment identifier includes anonymous domain information
  • the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication mode includes an external authentication mode or an internal authentication mode
  • the configuration information includes identifiers of one or more networks corresponding to the external authentication mode and/or identifiers of one or more networks corresponding to the internal authentication mode.
  • the authentication acquisition response message includes authentication indication information for indicating the authentication mode.
  • the communication device 900 may further include a storage module (not shown in FIG. 9 ), where programs or instructions are stored in the storage module.
  • the processing module 902 executes the program or instruction
  • the communication device 900 can execute the unified data management function in the communication methods shown in FIGS. 4-7 .
  • the communication device 900 may be a unified data management, or a chip (system) or other components or components that may be configured in the unified data management, which is not limited in this application.
  • the communication device 900 shown in FIG. 9 can be applied to the communication system shown in FIG. 1 and FIG. 2, and perform the authentication in the communication method shown in FIG. 3-FIG. function of the server function.
  • the transceiver module 901 is configured to send an authentication acquisition request message to the unified data management.
  • the transceiver module 901 is also configured to receive an authentication acquisition response message from the unified data management.
  • the processing module 902 is configured to send an authentication request message to the authentication and authorization functions specific to the network slice and the independent non-public network according to the authentication indication information.
  • the transceiver module 901 is further configured to receive authentication response messages from authentication and authorization functions specific to network slices and independent non-public networks.
  • the transceiver module 901 is further configured to send an authentication result confirmation request message to the unified data management.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier
  • the anonymous subscription concealment identifier includes anonymous domain information
  • the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication acquisition response message includes the authentication instruction information and the anonymous subscription permanent identifier, and the authentication instruction information is used to indicate the authentication method for authenticating the terminal device.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • Authentication methods include external authentication methods or internal authentication methods. The authentication request message is used to request authentication of the terminal device, and the authentication request message includes an anonymous subscription permanent identifier.
  • the authentication response message includes the real subscription permanent identifier and/or authentication success message
  • the real subscription permanent identifier includes real user name information
  • the real user name information is used to identify the terminal device
  • the authentication success message is used to indicate that the terminal device is successfully authenticated .
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the communication device 900 may further include a storage module (not shown in FIG. 9 ), where programs or instructions are stored in the storage module.
  • the processing module 902 executes the program or instruction
  • the communication device 900 can execute the function of the authentication server function in the communication methods shown in FIGS. 3-7 .
  • the communication device 900 may be an authentication server function, or a chip (system) or other components or components that may be configured in the authentication server function, which is not limited in this application.
  • the communication device 900 shown in FIG. 9 can be applied to the communication system shown in FIG. 1 and FIG. 2, and perform the authentication in the communication method shown in FIG. 3-FIG. function of the server function.
  • the transceiver module 901 is configured to send an authentication acquisition request message to the unified data management.
  • the transceiver module 901 is also configured to receive an authentication acquisition response message from the unified data management.
  • the transceiver module 901 is further configured to send an authentication request message to the authentication and authorization functions specific to the network slice and the independent non-public network according to the authentication indication information.
  • the transceiver module 901 is further configured to receive authentication response messages from authentication and authorization functions specific to network slices and independent non-public networks.
  • the processing module 902 is configured to generate first network-side verification information according to the root key, the real subscription permanent identifier, and the network-side counter value in response to the authentication success message.
  • the transceiver module 901 is further configured to send an authentication response message to the access and mobility management function, where the authentication response message includes an authentication success message, first verification information on the network side, and a counter value on the network side.
  • the transceiver module 901 is also configured to receive an authentication authentication intermediate message from an access and mobility management function.
  • the processing module 902 is further configured to generate second verification information on the network side according to the root key, the real subscription permanent identifier and the counter value on the terminal side.
  • the processing module 902 is further configured to determine whether the second verification information on the terminal side is consistent with the second verification information on the network side.
  • the transceiver module 901 is further configured to send an authentication result confirmation request message to the unified data management.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier, and the anonymous subscription concealment identifier includes anonymous domain information, and the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication acquisition response message includes authentication indication information and an anonymous subscription permanent identifier, and the authentication indication information is used to indicate an authentication mode for authenticating the terminal device.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • Authentication methods include external authentication methods or internal authentication methods.
  • the authentication request message is used to request authentication of the terminal device, and the authentication request message includes an anonymous subscription permanent identifier.
  • the authentication response message includes the real subscription permanent identifier, the authentication success message and the root key.
  • the real subscription permanent identifier includes the real user name information, the real username information is used to identify the terminal device, and the authentication success message is used to indicate that the terminal device is authenticated. success.
  • the authentication authentication intermediate message includes the second verification information on the terminal side and the counter value on the terminal side.
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the communication device 900 may further include a storage module (not shown in FIG. 9 ), where programs or instructions are stored in the storage module.
  • the processing module 902 executes the program or instruction
  • the communication device 900 can execute the function of the authentication server function in the communication methods shown in FIGS. 3-7 .
  • the communication device 900 may be an authentication server function, or a chip (system) or other components or components that may be configured in the authentication server function, which is not limited in this application.
  • the communication device 900 shown in FIG. 9 can be applied to the communication system shown in FIG. 1 and FIG. 2, and perform the authentication in the communication method shown in FIG. 3-FIG. function of the server function.
  • the transceiver module 901 is configured to send an authentication acquisition request message to the unified data management.
  • the transceiver module 901 is also configured to receive an authentication acquisition response message from the unified data management.
  • the processing module 902 is configured to send an authentication request message to the authentication and authorization functions specific to the network slice and the independent non-public network according to the authentication indication information.
  • the transceiver module 901 is further configured to receive authentication response messages from authentication and authorization functions specific to network slices and independent non-public networks.
  • the transceiver module 901 is also configured to send an authentication response message to the access and mobility management function.
  • the transceiver module 901 is also configured to receive an authentication result message from an access and mobility management function.
  • the transceiver module 901 is further configured to send an authentication result confirmation request message to the unified data management.
  • the authentication acquisition request message includes an anonymous subscription concealment identifier, and the anonymous subscription concealment identifier includes anonymous domain information, and the anonymous domain information is used to indicate the identifier of the network to which the authentication device capable of authenticating the terminal device belongs.
  • the authentication acquisition response message includes authentication indication information and an anonymous subscription permanent identifier, and the authentication indication information is used to indicate an authentication mode for authenticating the terminal device.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • Authentication methods include external authentication methods or internal authentication methods. The authentication request message is used to request authentication of the terminal device, and the authentication request message includes an anonymous subscription permanent identifier.
  • the authentication response message includes the real subscription permanent identifier and/or authentication success message, the real subscription permanent identifier includes real user name information, the real user name information is used to identify the terminal device, and the authentication success message is used to indicate that the terminal device is successfully authenticated .
  • the authentication authentication response message includes the real subscription permanent identifier and/or authentication success message.
  • the authentication authentication result message includes authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the authentication result confirmation request message includes the real subscription permanent identifier and authentication result indication information.
  • the communication device 900 may further include a storage module (not shown in FIG. 9 ), where programs or instructions are stored in the storage module.
  • the processing module 902 executes the program or instruction
  • the communication device 900 can execute the function of the authentication server function in the communication methods shown in FIGS. 3-7 .
  • the communication device 900 may be an authentication server function, or a chip (system) or other components or components that may be configured in the authentication server function, which is not limited in this application.
  • the communication device 900 shown in FIG. 9 can be applied to the communication system shown in FIG. 1 and FIG. 2, and the terminal equipment in the communication method shown in FIG. 3-FIG. function.
  • the processing module 902 is configured to determine the hidden identity of the anonymous contract.
  • the transceiver module 901 is configured to send a registration request message to the access and mobility management function.
  • the hidden identity of the anonymous subscription includes anonymous domain information, anonymous user name information and routing indicator, the anonymous domain information is used to indicate the identity of the network to which the authentication device that can authenticate the communication device belongs, and the anonymous user name information is the default value.
  • the registration request message includes the hidden identity of the anonymous subscription.
  • the processing module 902 is further configured to execute an authentication process with an external authentication server and generate a root key.
  • the transceiver module 901 is configured to receive a non-access stratum security mode command message from an access and mobility management function, where the non-access stratum security mode command message includes an authentication success message.
  • the processing module 902 is further configured to generate an intermediate key according to the root key and the real subscription permanent identifier in response to the authentication success message. Wherein, the authentication success message is used to indicate that the communication device is authenticated successfully.
  • the real subscription permanent identification includes real user name information, and the real user name information is used to identify the communication device.
  • the processing module 902 is further configured to execute an authentication process with an external authentication server and generate a root key.
  • the transceiver module 901 is configured to receive a non-access stratum security mode command message from an access and mobility management function.
  • the processing module 902 is further configured to generate terminal-side first verification information according to the root key, the real subscription permanent identifier, and the network-side counter value in response to the authentication success message.
  • the processing module 902 is further configured to determine whether the first verification information on the terminal side is consistent with the first verification information on the network side.
  • the processing module 902 is further configured to generate second verification information on the terminal side according to the root key, the real subscription permanent identifier, and the counter value on the terminal side.
  • the transceiver module 901 is further configured to send the N1 message to the access and mobility management function.
  • the non-access stratum security mode command message includes an authentication success message, network-side first verification information and a network-side counter value, and the authentication success message is used to indicate that the authentication of the communication device is successful.
  • the real subscription permanent identification includes real user name information, and the real user name information is used to identify the communication device.
  • the N1 message includes the second verification information on the terminal side and the counter value on the terminal side.
  • the processing module 902 is further configured to generate an intermediate key according to the root key, and generate first terminal-side verification information according to the intermediate key, the real subscription permanent identifier and the network-side counter value.
  • the communication device 900 may further include a storage module (not shown in FIG. 9 ), where programs or instructions are stored in the storage module.
  • the processing module 902 executes the program or instruction
  • the communication apparatus 900 can execute the functions of the terminal device in the communication methods shown in FIGS. 3-7 .
  • the communication device 900 may be a terminal device, or a chip (system) or other components or components that may be provided in the terminal device, which is not limited in this application.
  • the communication device 900 shown in FIG. 9 can be applied to the communication system shown in FIG. 1 and FIG. 2 , and implement network slicing in the communication methods shown in FIGS. 4-7 and independent non-public network-specific authentication and authorization functions.
  • the transceiver module 901 is configured to receive an authentication request message from an authentication server function.
  • the transceiver module 901 is also configured to receive a protocol response message from an external authentication device.
  • the processing module 902 is configured to determine whether the anonymous domain information matches the real domain information.
  • the transceiver module 901 is further configured to send an authentication response message to the authentication server function.
  • the authentication request message may include an anonymous subscription permanent identifier.
  • Anonymous signed permanent identifiers include anonymous domain information.
  • the protocol response message may include the real subscription permanent identifier, and may also include an authentication success message, and/or a root key MSK.
  • the authentication response message may include authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the communication device 900 may further include a storage module (not shown in FIG. 9 ), where programs or instructions are stored in the storage module.
  • the processing module 902 executes the program or instruction, the communication device 900 can perform the functions of network slicing and independent non-public network-specific authentication and authorization functions in the communication methods shown in FIGS. 4-7 .
  • the communication device 900 may be a network slice and an independent non-public network-specific authentication and authorization function, or may be a chip (system) that can be configured for a network slice and an independent non-public network-specific authentication and authorization function Or other components or components, the application does not limit this.
  • the communication device 1000 shown in FIG. 10 is applicable to the communication system shown in FIG. 1 and FIG. 2, and performs the access and Mobility management functions.
  • the receiving module 1002 is configured to receive a registration request message from a terminal device.
  • the sending module 1001 is further configured to send an authentication request message to the authentication server function.
  • the receiving module 1002 is also configured to receive an authentication response message from the authentication server function.
  • the sending module 1001 is further configured to send an authentication result message to the authentication server function when the terminal device successfully executes the non-access stratum security mode command process.
  • the registration request message includes an anonymous subscription hidden identifier
  • the anonymous signed hidden identifier includes anonymous domain information, anonymous user name information, and a routing indicator
  • the anonymous domain information is used to indicate the identity of the network to which the authentication device capable of authenticating the terminal device belongs.
  • ID anonymous username information is the default.
  • the authentication authentication request message includes the hidden identity of the anonymous contract.
  • the authentication authentication response message includes a real subscription permanent identifier and/or an authentication success message, the real subscription permanent identifier includes real user name information, the real user name information is used to identify the terminal device, and the authentication success message is used to indicate that the terminal device is authenticated. right to success.
  • the authentication and authentication result message includes the real subscription permanent identifier and authentication result indication information, and the authentication result indication information indicates that the terminal device has successfully authenticated.
  • the communication device 1000 may further include a processing module 1003 and a storage module (not shown in FIG. 10 ), where programs or instructions are stored in the storage module.
  • the processing module 1003 executes the program or instruction, the communication device 1000 can perform the access and mobility management functions in the communication methods shown in FIGS. 4-7 .
  • the communication device 1000 may be an access and mobility management function, or a chip (system) or other components or components that may be configured for the access and mobility management function, which is not limited in this application.
  • An embodiment of the present application provides a communication system.
  • the communication system includes: unified data management, and authentication server functions.
  • the communication system may also include network slicing and independent non-public network specific authentication and authorization functions, access and mobility management functions, and external authentication servers.
  • the unified data management is used to execute the actions of the unified data management in the above method embodiments, and the specific execution method and process may refer to the above method embodiments, which will not be repeated here.
  • the authentication server function is used to execute the actions of the authentication server function in the above method embodiments, and the specific execution method and process can refer to the above method embodiments, and will not be repeated here.
  • the authentication and authorization functions specific to network slicing and independent non-public networks are used to execute the actions of the authentication and authorization functions specific to network slicing and independent non-public networks in the above method embodiments.
  • the specific execution methods and processes can refer to the above method embodiments , which will not be repeated here.
  • the access and mobility management function is used to execute the actions of the access and mobility management function in the above method embodiment.
  • the specific execution method and process can refer to the above method embodiment, and will not be repeated here.
  • the external authentication server is used to execute the actions of the external authentication server in the above method embodiments, and the specific execution method and process may refer to the above method embodiments, which will not be repeated here.
  • An embodiment of the present application provides a chip system, and the chip system includes a logic circuit and an input/output port.
  • the logic circuit can be used to realize the processing function involved in the communication method provided by the embodiment of the present application
  • the input/output port can be used for the sending and receiving function involved in the communication method provided in the embodiment of the present application.
  • the input port can be used to realize the receiving function involved in the communication method provided by the embodiment of the present application
  • the output port can be used to realize the sending function involved in the communication method provided in the embodiment of the present application.
  • the processor in the communication device 800 may be used to perform, for example but not limited to, baseband related processing, and the transceiver in the communication device 800 may be used to perform, for example but not limited to, radio frequency transceiving.
  • the above-mentioned devices may be respectively arranged on independent chips, or at least partly or all of them may be arranged on the same chip.
  • processors can be further divided into analog baseband processors and digital baseband processors.
  • the analog baseband processor can be integrated with the transceiver on the same chip, and the digital baseband processor can be set on an independent chip.
  • a digital baseband processor can be combined with a variety of application processors (such as but not limited to graphics processors, multimedia processors, etc.) integrated on the same chip.
  • application processors such as but not limited to graphics processors, multimedia processors, etc.
  • Such a chip can be called a system chip (system on chip). Whether each device is independently arranged on different chips or integrated and arranged on one or more chips often depends on the specific needs of product design.
  • the embodiments of the present application do not limit the specific implementation forms of the foregoing devices.
  • the chip system further includes a memory, and the memory is used to store program instructions and data for implementing functions involved in the communication method provided by the embodiment of the present application.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • the embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores a computer program or instruction, and when the computer program or instruction is run on a computer, the communication method provided in the embodiment of the present application is executed.
  • An embodiment of the present application provides a computer program product, and the computer program product includes: a computer program or an instruction, and when the computer program or instruction is run on a computer, the communication method provided in the embodiment of the present application is executed.
  • the processor in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processor, DSP), dedicated integrated Circuit (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • static random access memory static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory Access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • the above-mentioned embodiments may be implemented in whole or in part by software, hardware (such as circuits), firmware, or other arbitrary combinations.
  • the above-described embodiments may be implemented in whole or in part in the form of computer program products.
  • the computer program product comprises one or more computer instructions or computer programs. When the computer instruction or computer program is loaded or executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more sets of available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media.
  • the semiconductor medium may be a solid state drive.
  • At least one means one or more, and “multiple” means two or more.
  • At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • at least one item (piece) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .
  • sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种通信方法、装置及系统，可以确定对终端设备进行鉴权的方式。通信系统包括：统一数据管理、和鉴权服务器功能。统一数据管理，用于根据匿名域信息和配置信息，确定对终端设备进行鉴权的鉴权方式，向鉴权服务器功能发送鉴权获取响应消息。鉴权服务器功能，用于根据鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息。匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识，鉴权方式包括外部鉴权方式或者内部鉴权方式，配置信息包括外部鉴权方式对应的一个或者多个网络的标识、和/或内部鉴权方式对应的一个或者多个网络的标识，鉴权获取响应消息包括指示鉴权方式的鉴权指示信息。

Description

通信方法、装置及系统
本申请要求于2021年10月30日提交国家知识产权局、申请号为202111278529.6、申请名称为“通信方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种通信方法、装置及系统。
背景技术
现有的鉴权包括两种方式，一种方式为鉴权授权计费服务器(authentication authorization accounting，AAA)服务器与终端设备完成鉴权过程，该AAA服务器不属于为该终端设备提供网络服务的身份验证服务器功能AUSF(authentication server function，AUSF)网元所属的网络，可以简称为外部鉴权方式；另一种方式为AUSF网元与终端设备完成鉴权过程，该AUSF网元与终端设备属于同一网络，可以简称为内部鉴权方式。示例性地。鉴权过程可以包括网络对终端设备进行鉴权和终端设备对网络进行鉴权，防止非法终端设备占用网络资源，以及防止终端设备进入非法的网络，被骗取关键信息。
然而，对于如何确定使用外部鉴权方式、还是内部鉴权方式，业界尚未给出相应的方案。
发明内容
本申请实施例提供一种通信方法、装置及系统，提供了确定鉴权方式的方案，可以确定对终端设备进行鉴权的方式。
为达到上述目的，本申请采用如下技术方案：
第一方面，提供一种通信系统。该通信系统包括：统一数据管理、和鉴权服务器功能。其中，
鉴权服务器功能，用于向统一数据管理发送鉴权获取请求消息。其中，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。
统一数据管理，用于接收来自鉴权服务器功能的鉴权获取请求消息，根据匿名域信息和配置信息，确定对终端设备进行鉴权的鉴权方式，向鉴权服务器功能发送鉴权获取响应消息。其中，鉴权方式包括外部鉴权方式或者内部鉴权方式，配置信息包括外部鉴权方式对应的一个或者多个网络的标识、和/或内部鉴权方式对应的一个或者多个网络的标识。鉴权获取响应消息包括指示鉴权方式的鉴权指示信息和匿名签约永久标识。匿名签约永久标识包括匿名域信息。
鉴权服务器功能，还用于接收来自统一数据管理的鉴权获取响应消息，根据鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息。 其中，认证请求消息用于请求对终端设备进行鉴权，认证请求消息包括匿名签约永久标识。
基于第一方面所述的通信系统，统一数据管理接收包括匿名域信息的匿名签约隐藏标识，该匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识，根据匿名域信息和配置信息确定鉴权指示信息，该鉴权指示信息用于指示鉴权的方式，配置信息包括外部鉴权方式对应的一个或者多个网络的标识、和/或内部鉴权方式对应的一个或者多个网络的标识，如此，可以成功确定对终端设备进行鉴权的方式。
在一种可能的设计方式中，匿名签约隐藏标识还可以包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
在一种可能的设计方式中，第一方面提供的通信系统还可以包括网络切片和独立非公共网络特定的鉴权和授权功能。
网络切片和独立非公共网络特定的鉴权和授权功能，用于接收来自鉴权服务器功能的认证请求消息。向鉴权服务器功能发送认证响应消息。其中，认证响应消息可以包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识可以包括真实用户名信息，真实用户名信息可以用于标识终端设备，鉴权成功消息可以用于指示对终端设备鉴权成功。
鉴权服务器功能，还用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息。在真实域信息与匿名域信息匹配的情况下，向统一数据管理发送鉴权结果确认请求消息。其中，鉴权结果确认请求消息可以包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
统一数据管理，还用于接收来自鉴权服务器功能的鉴权结果确认请求消息，保存真实签约永久标识和鉴权结果指示信息。
如此，鉴权服务器功能根据匿名域信息和真实域信息，确定外部鉴权设备进行鉴权的过程中所使用的真实签约永久标识与终端设备侧的真实签约永久标识是否相同，若相同，则可以完成终端设备与网络侧的双向认证，终端设备认为网络是真实的，网络认为终端设备是真实的。
在一种可能的设计方式中，认证响应消息还可以包括根密钥。鉴权服务器功能，还用于根据根密钥以及真实签约永久标识，生成中间密钥。
在一种可能的设计方式中，认证响应消息还包括根密钥，第一方面提供的通信系统还可以包括：接入和移动性管理功能和网络切片和独立非公共网络特定的鉴权和授权功能。
网络切片和独立非公共网络特定的鉴权和授权功能，用于接收来自鉴权服务器功能的认证请求消息。向鉴权服务器功能发送认证响应消息。其中，认证响应消息包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。
鉴权服务器功能，还用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息。响应于鉴权成功消息，根据根密钥、真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息。向接入和移动性管理功能发送鉴权认证响应消息，鉴权认证响应消息包括鉴权成功消息、网络侧第一验证信息和网络侧计数器值。
接入和移动性管理功能，用于接收来自鉴权服务器功能的鉴权认证响应消息，向终端设备发送非接入层安全模式命令消息。其中，非接入层安全模式命令消息包括鉴权成功消息、网络侧第一验证信息和网络侧计数器值。
接入和移动性管理功能，还用于向鉴权服务器功能发送鉴权认证中间消息。其中，鉴权认证中间消息包括终端侧第二验证信息和终端侧计数器值。
鉴权服务器功能，还用于接收来自接入和移动性管理功能的鉴权认证中间消息。根据根密钥、真实签约永久标识和终端侧计数器值，生成网络侧第二验证信息。判断终端侧第二验证信息与网络侧第二验证信息是否一致。在终端侧第二验证信息与网络侧第二验证信息一致的情况下，向统一数据管理发送鉴权结果确认请求消息。其中，鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
统一数据管理，还用于接收来自鉴权服务器功能的鉴权结果确认请求消息。保存真实签约永久标识和鉴权结果指示信息。
如此，通过确认终端设备侧的验证信息与网络侧的验证信息是否相同，来确定用于进行鉴权的真实签约永久标识与真实签约永久标识是否相同，如此，可以完成终端设备与网络侧的双向认证，终端设备认为网络是真实的，网络认为终端设备是真实的。
在一种可能的设计方式中，鉴权服务器功能，还用于根据根密钥，生成中间密钥，根据中间密钥、真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息。如此，用真实签约永久标识生成网络侧第一验证信息，终端设备收到该第一验证信息后，可以确认鉴权设备进行鉴权时采用的真实签约永久标识与终端设备的真实签约永久标识是否相同。
在一种可能的设计方式中，认证响应消息还包括根密钥，通信系统还可以包括：接入和移动性管理功能和网络切片和独立非公共网络特定的鉴权和授权功能。
网络切片和独立非公共网络特定的鉴权和授权功能，用于接收来自鉴权服务器功能的认证请求消息，向鉴权服务器功能发送认证响应消息。其中，认证响应消息包括真实签约永久标识、鉴权成功消息、和根密钥，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。
鉴权服务器功能，还用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息。向接入和移动性管理功能发送鉴权认证响应消息。其中，鉴权认证响应消息包括真实签约永久标识、和/或鉴权成功消息、中间密钥Kseaf。
接入和移动性管理功能，用于接收来自鉴权服务器功能的鉴权认证响应消息，向终端设备发送非接入层安全模式命令消息。其中，非接入层安全模式命令消息包括鉴权成功消息。
在接入和移动性管理功能与终端设备成功执行非接入层安全模式命令流程的情况下，接入和移动性管理功能，还用于向鉴权服务器功能发送鉴权认证结果消息。其中，鉴权认证结果消息包括鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
鉴权服务器功能，还用于接收来自接入和移动性管理功能的鉴权认证结果消息。向接入和移动性管理功能发送鉴权认证结果响应消息。
接入和移动性管理功能，还用于接收来自鉴权服务器功能的鉴权认证结果响应消 息。
鉴权服务器功能，还用于响应于鉴权结果指示信息，向统一数据管理发送鉴权结果确认请求消息。其中，鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息。
统一数据管理，还用于接收来自鉴权服务器功能的鉴权结果确认请求消息，保存真实签约永久标识和鉴权结果指示信息。
如此，在鉴权流程后执行非接入层安全模式命令流程，若非接入层安全模式命令流程成功，可得出用于鉴权的真实签约永久标识与终端设备的真实签约永久标识相同，从而外部鉴权设备进行鉴权的过程中所使用的信任状对应的身份信息与终端设备侧的信任状对应的身份信息相同。如此，可以完成终端设备与网络侧的双向认证，终端设备认为网络是真实的，网络认为终端设备是真实的。
在一种可能的设计方式中，第一方面所述的通信系统还可以包括：外部鉴权设备。外部鉴权设备用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能的协议请求消息，对终端设备进行鉴权，向网络切片和独立非公共网络特定的鉴权和授权功能发送协议响应消息。可选地，协议请求消息可以包括匿名签约永久标识、或者包括匿名域信息且不包括匿名签约永久标识中除匿名域信息以外的信息。协议响应消息可以包括真实签约永久标识，还可以包括鉴权成功消息、和/或根密钥。如此，可以采用外部鉴权的方式对终端设备进行鉴权。
第二方面，提供一种通信方法。该通信方法，包括：接收来自鉴权服务器功能的鉴权获取请求消息,根据匿名域信息和配置信息，确定对终端设备进行鉴权的鉴权方式，向鉴权服务器功能发送鉴权获取响应消息。其中，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权方式包括外部鉴权方式或者内部鉴权方式，配置信息包括外部鉴权方式对应的一个或者多个网络的标识、和/或内部鉴权方式对应的一个或者多个网络的标识。鉴权获取响应消息包括用于指示鉴权方式的鉴权指示信息。
在一种可能的设计方式中，上述根据域信息和配置信息，确定对终端进行鉴权的鉴权方式，可以包括：在能够对终端设备进行鉴权的鉴权设备所属的网络的标识与外部鉴权方式对应的一个或者多个网络的标识匹配的情况下，确定对终端设备进行鉴权的鉴权方式是外部鉴权方式。或者，在能够对设备终端设备进行鉴权的鉴权设备所属的网络的标识与内部鉴权方式对应的一个或者多个网络的标识匹配的情况下，确定对终端设备进行鉴权的鉴权方式是内部鉴权方式。
在一种可能的设计方式中，鉴权获取响应消息还包括匿名签约永久标识，匿名签约永久标识是根据匿名签约隐藏标识确定的，匿名签约永久标识包括匿名域信息。
在一种可能的设计方式中，匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
在一种可能的设计方式中，第二方面提供的通信方法，还可以包括：接收来自鉴权服务器功能的鉴权结果确认请求消息,保存真实签约永久标识和鉴权结果指示信息。其中，鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果 指示信息指示终端设备鉴权成功。真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备。
此外，第二方面所述的通信方法的技术效果可以参考第一方面中任一种可能的实现方式所述的通信系统的技术效果，此处不再赘述。
第三方面，提供一种通信方法。该方法包括：向统一数据管理发送鉴权获取请求消息,接收来自统一数据管理的鉴权获取响应消息，根据鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息，接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息，在真实域信息与匿名域信息匹配的情况下，向统一数据管理发送鉴权结果确认请求消息。
其中，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，鉴权指示信息用于指示对终端设备进行鉴权的鉴权方式。匿名签约永久标识包括匿名域信息。鉴权方式包括外部鉴权方式或者内部鉴权方式。认证请求消息用于请求对终端设备进行鉴权，认证请求消息包括匿名签约永久标识。认证响应消息包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
在一种可能的设计方式中，认证响应消息还包括根密钥，第三方面提供的通信方法，还可以包括：根据根密钥以及真实签约永久标识，生成中间密钥。
在一种可能的设计方式中，匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
此外，第三方面所述的通信方法的技术效果可以参考第一方面中任一种可能的实现方式所述的通信系统的技术效果，此处不再赘述。
第四方面，提供一种通信方法。该方法包括：向统一数据管理发送鉴权获取请求消息，接收来自统一数据管理的鉴权获取响应消息，根据鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息，接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息，响应于鉴权成功消息，根据根密钥、真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息，向接入和移动性管理功能发送鉴权认证响应消息，鉴权认证响应消息包括鉴权成功消息、网络侧第一验证信息和网络侧计数器值，接收来自接入和移动性管理功能的鉴权认证中间消息，根据根密钥、真实签约永久标识和终端侧计数器值，生成网络侧第二验证信息。判断终端侧第二验证信息与网络侧第二验证信息是否一致。在终端侧第二验证信息与网络侧第二验证信息一致的情况下，向统一数据管理发送鉴权结果确认请求消息。
其中，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，鉴权指示信息用于指示对终端设备进行鉴权的鉴权方式。匿名签约永久标识包括匿名域信息。鉴权方式包括外部鉴权方式或者内部鉴权方式。认证请求消息用于请求对终端设备进行鉴权，认证请 求消息包括匿名签约永久标识。认证响应消息包括真实签约永久标识、鉴权成功消息和根密钥，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权认证中间消息包括终端侧第二验证信息和终端侧计数器值。鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息。
在一种可能的设计方式中，匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
在一种可能的设计方式中，上述根据根密钥、真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息，包括：根据根密钥，生成中间密钥，根据中间密钥、真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息。
此外，第四方面所述的通信方法的技术效果可以参考第一方面中任一种可能的实现方式所述的通信系统的技术效果，此处不再赘述。
第五方面，提供一种通信方法。该方法包括：向统一数据管理发送鉴权获取请求消息。接收来自统一数据管理的鉴权获取响应消息。根据鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息。接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息。向接入和移动性管理功能发送鉴权认证响应消息。接收来自接入和移动性管理功能的鉴权认证结果消息。响应于鉴权结果指示信息，向统一数据管理发送鉴权结果确认请求消息。
其中，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，鉴权指示信息用于指示对终端设备进行鉴权的鉴权方式。匿名签约永久标识包括匿名域信息。鉴权方式包括外部鉴权方式或者内部鉴权方式。认证请求消息用于请求对终端设备进行鉴权，认证请求消息包括匿名签约永久标识。认证响应消息包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权认证响应消息包括真实签约永久标识、和/或鉴权成功消息。鉴权认证结果消息包括鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息。
在一种可能的设计方式中，认证响应消息还包括根密钥，第五方面提供的通信方法，还可以包括：根据根密钥，生成中间密钥。
在一种可能的设计方式中，匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
此外，第五方面所述的通信方法的技术效果可以参考第一方面中任一种可能的实现方式所述的通信系统的技术效果，此处不再赘述。
第六方面，提供一种通信方法。该方法包括：在未获得公钥的情况下，确定匿名签约隐藏标识，向接入和移动性管理功能发送注册请求消息。其中，匿名签约隐藏标识包括匿名域信息、匿名用户名信息和路由指示符，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识，匿名用户名信息为缺省值。注册请求消 息包括匿名签约隐藏标识。
在一种可能的设计方式中，第六方面提供的通信方法，还可以包括：与外部鉴权设备执行鉴权流程，并生成根密钥,接收来自接入和移动性管理功能的非接入层安全模式命令消息，非接入层安全模式命令消息包括鉴权成功消息，响应于鉴权成功消息，根据根密钥以及真实签约永久标识，生成中间密钥。其中，鉴权成功消息用于指示对终端设备鉴权成功。真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备。
在一种可能的设计方式中，第六方面提供的通信方法，还可以包括：与外部鉴权设备执行鉴权流程，并生成根密钥。接收来自接入和移动性管理功能的非接入层安全模式命令消息，响应于鉴权成功消息，根据根密钥、真实签约永久标识和网络侧计数器值，生成终端侧第一验证信息,判断终端侧第一验证信息与网络侧第一验证信息是否一致。在终端侧第一验证信息与网络侧第一验证信息一致的情况下，根据根密钥、真实签约永久标识和终端侧计数器值，生成终端侧第二验证信息。向接入和移动性管理功能发送N1消息。其中，非接入层安全模式命令消息包括鉴权成功消息、网络侧第一验证信息和网络侧计数器值，鉴权成功消息用于指示对终端设备鉴权成功。真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备。N1消息包括终端侧第二验证信息和终端侧计数器值。
在一种可能的设计方式中，上述根据根密钥、真实签约永久标识和网络侧计数器值，生成终端侧第一验证信息，可以包括：根据根密钥，生成中间密钥，根据中间密钥、真实签约永久标识和网络侧计数器值，生成终端侧第一验证信息。
此外，第六方面所述的通信方法的技术效果可以参考第一方面中任一种可能的实现方式所述的通信系统的技术效果，此处不再赘述。
第七方面，提供一种通信方法。该方法包括：接收来自终端设备的注册请求消息，向鉴权服务器功能发送鉴权认证请求消息，接收来自鉴权服务器功能的鉴权认证响应消息，在与终端设备成功执行非接入层安全模式命令流程的情况下，向鉴权服务器功能发送鉴权认证结果消息。
其中，注册请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息、匿名用户名信息和路由指示符，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识，匿名用户名信息为缺省值。鉴权认证请求消息包括匿名签约隐藏标识。鉴权认证响应消息包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权认证结果消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
此外，第七方面所述的通信方法的技术效果可以参考第一方面中任一种可能的实现方式所述的通信系统的技术效果，此处不再赘述。
第八方面，提供一种通信方法。该方法包括：接收来自鉴权服务器功能的认证请求消息，接收来自外部鉴权设备的协议响应消息，判断匿名域信息与真实域信息是否匹配，在真实域信息与匿名域信息匹配的情况下，向鉴权服务器功能发送认证响应消息。其中，认证请求消息可以包括匿名签约永久标识。匿名签约永久标识包括匿名域 信息。协议响应消息可以包括真实签约永久标识，还可以包括鉴权成功消息、和/或根密钥。认证响应消息可以包括鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
在一种可能的设计方式中，匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
此外，第八方面所述的通信方法的技术效果可以参考第一方面中任一种可能的实现方式所述的通信系统的技术效果，此处不再赘述。
第九方面，提供一种通信装置。该通信装置，包括：处理模块和收发模块。其中，收发模块，用于接收来自鉴权服务器功能的鉴权获取请求消息。处理模块，用于根据匿名域信息和配置信息，确定对终端设备进行鉴权的鉴权方式。收发模块，还用于向鉴权服务器功能发送鉴权获取响应消息。其中，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权方式包括外部鉴权方式或者内部鉴权方式，配置信息包括外部鉴权方式对应的一个或者多个网络的标识、和/或内部鉴权方式对应的一个或者多个网络的标识。鉴权获取响应消息包括用于指示鉴权方式的鉴权指示信息。
在一种可能的设计方式中，在能够对终端设备进行鉴权的鉴权设备所属的网络的标识与外部鉴权方式对应的一个或者多个网络的标识匹配的情况下，处理模块，还用于确定对终端设备进行鉴权的鉴权方式是外部鉴权方式。或者，在能够对设备终端设备进行鉴权的鉴权设备所属的网络的标识与内部鉴权方式对应的一个或者多个网络的标识匹配的情况下，处理模块，还用于确定对终端设备进行鉴权的鉴权方式是内部鉴权方式。
在一种可能的设计方式中，鉴权获取响应消息还包括匿名签约永久标识，匿名签约永久标识是根据匿名签约隐藏标识确定的，匿名签约永久标识包括匿名域信息。
在一种可能的设计方式中，匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
在一种可能的设计方式中，收发模块，还用于接收来自鉴权服务器功能的鉴权结果确认请求消息。
第九方面所述的通信装置还可以包括存储模块，该存储模块，用于保存真实签约永久标识和鉴权结果指示信息。其中，鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备。
需要说明的是，第九方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自鉴权服务器功能、和/或其他网元的数据和/或信令；发送模块用于向鉴权服务器功能、和/或其他网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，当处理模块执行该程序或指令时，使得第九方面所述的通信装置可以执行第二方面所述的方法。
需要说明的是，第九方面所述的通信装置可以是统一数据管理，也可以是可设置 于统一数据管理的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第九方面所述的通信装置的技术效果可以参考第二方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第十方面，提供一种通信装置。该通信装置，包括：处理模块和收发模块。其中，收发模块，用于向统一数据管理发送鉴权获取请求消息。收发模块，还用于接收来自统一数据管理的鉴权获取响应消息。处理模块，用于根据鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息。收发模块，还用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息。在真实域信息与匿名域信息匹配的情况下，收发模块，还用于向统一数据管理发送鉴权结果确认请求消息。
其中，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，鉴权指示信息用于指示对终端设备进行鉴权的鉴权方式。匿名签约永久标识包括匿名域信息。鉴权方式包括外部鉴权方式或者内部鉴权方式。认证请求消息用于请求对终端设备进行鉴权，认证请求消息包括匿名签约永久标识。认证响应消息包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
在一种可能的设计方式中，认证响应消息还包括根密钥。处理模块，还用于根据根密钥以及真实签约永久标识，生成中间密钥。
在一种可能的设计方式中，匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
需要说明的是，第十方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能、接入和移动性管理功能、统一数据管理、和/或其他网元的数据和/或信令；发送模块用于向网络切片和独立非公共网络特定的鉴权和授权功能、接入和移动性管理功能、统一数据管理、和/或其他网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第十方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十方面所述的通信装置可以执行第三方面所述的方法。
需要说明的是，第十方面所述的通信装置可以是鉴权服务器功能，也可以是可设置于鉴权服务器功能的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十方面所述的通信装置的技术效果可以参考第三方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第十一方面，提供一种通信装置。该通信装置，包括：处理模块和收发模块。其中，收发模块，用于向统一数据管理发送鉴权获取请求消息。收发模块，还用于接收来自统一数据管理的鉴权获取响应消息。收发模块，还用于根据鉴权指示信息，向网 络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息。收发模块，还用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息。处理模块，用于响应于鉴权成功消息，根据根密钥、真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息。收发模块，还用于向接入和移动性管理功能发送鉴权认证响应消息，鉴权认证响应消息包括鉴权成功消息、网络侧第一验证信息和网络侧计数器值。收发模块，还用于接收来自接入和移动性管理功能的鉴权认证中间消息。处理模块，还用于根据根密钥、真实签约永久标识和终端侧计数器值，生成网络侧第二验证信息。处理模块，还用于判断终端侧第二验证信息与网络侧第二验证信息是否一致。在终端侧第二验证信息与网络侧第二验证信息一致的情况下，收发模块，还用于向统一数据管理发送鉴权结果确认请求消息。
可选地，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，鉴权指示信息用于指示对终端设备进行鉴权的鉴权方式。匿名签约永久标识包括匿名域信息。鉴权方式包括外部鉴权方式或者内部鉴权方式。认证请求消息用于请求对终端设备进行鉴权，认证请求消息包括匿名签约永久标识。认证响应消息包括真实签约永久标识、鉴权成功消息和根密钥，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权认证中间消息包括终端侧第二验证信息和终端侧计数器值。鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
在一种可能的设计方式中，匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
在一种可能的设计方式中，处理模块，还用于根据根密钥，生成中间密钥，根据中间密钥、真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息。
需要说明的是，第十一方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能、接入和移动性管理功能、统一数据管理、和/或其他网元的数据和/或信令；发送模块用于向网络切片和独立非公共网络特定的鉴权和授权功能、接入和移动性管理功能、统一数据管理、和/或其他网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第十一方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十一方面所述的通信装置可以执行第四方面所述的方法。
需要说明的是，第十一方面所述的通信装置可以是鉴权服务器功能，也可以是可设置于鉴权服务器功能的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十一方面所述的通信装置的技术效果可以参考第四方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第十二方面，提供一种通信装置。该通信装置，包括：处理模块和收发模块。其中，收发模块，用于向统一数据管理发送鉴权获取请求消息。收发模块，还用于接收 来自统一数据管理的鉴权获取响应消息。处理模块，用于根据鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息。收发模块，还用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息。收发模块，还用于向接入和移动性管理功能发送鉴权认证响应消息。收发模块，还用于接收来自接入和移动性管理功能的鉴权认证结果消息。响应于鉴权结果指示信息，收发模块，还用于向统一数据管理发送鉴权结果确认请求消息。
可选地，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，鉴权指示信息用于指示对终端设备进行鉴权的鉴权方式。匿名签约永久标识包括匿名域信息。鉴权方式包括外部鉴权方式或者内部鉴权方式。认证请求消息用于请求对终端设备进行鉴权，认证请求消息包括匿名签约永久标识。认证响应消息包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权认证响应消息包括真实签约永久标识、和/或鉴权成功消息。鉴权认证结果消息包括鉴权结果指示信息。鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
在一种可能的设计方式中，认证响应消息还包括根密钥，处理模块，还用于根据根密钥，生成中间密钥。
在一种可能的设计方式中，匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
需要说明的是，第十二方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能、接入和移动性管理功能、统一数据管理、和/或其他网元的数据和/或信令；发送模块用于向网络切片和独立非公共网络特定的鉴权和授权功能、接入和移动性管理功能、统一数据管理、和/或其他网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第十二方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十二方面所述的通信装置可以执行第五方面所述的方法。
需要说明的是，第十二方面所述的通信装置可以是鉴权服务器功能，也可以是可设置于鉴权服务器功能的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十二方面所述的通信装置的技术效果可以参考第五方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第十三方面，提供一种通信装置。该通信装置，包括：处理模块和收发模块。其中，在未获得公钥的情况下，处理模块，用于确定匿名签约隐藏标识。收发模块，用于向接入和移动性管理功能发送注册请求消息。其中，匿名签约隐藏标识包括匿名域信息、匿名用户名信息和路由指示符，匿名域信息用于指示能够对通信装置进行鉴权的鉴权设备所属的网络的标识，匿名用户名信息为缺省值。注册请求消息包括匿名签 约隐藏标识。
在一种可能的设计方式中，处理模块，还用于与外部鉴权设备执行鉴权流程，并生成根密钥。收发模块，用于接收来自接入和移动性管理功能的非接入层安全模式命令消息，非接入层安全模式命令消息包括鉴权成功消息。处理模块，还用于响应于鉴权成功消息，根据根密钥以及真实签约永久标识，生成中间密钥。其中，鉴权成功消息用于指示对通信装置鉴权成功。真实签约永久标识包括真实用户名信息，真实用户名信息用于标识通信装置。
在一种可能的设计方式中，处理模块，还用于与外部鉴权设备执行鉴权流程，并生成根密钥。收发模块，用于接收来自接入和移动性管理功能的非接入层安全模式命令消息。处理模块，还用于响应于鉴权成功消息，根据根密钥、真实签约永久标识和网络侧计数器值，生成终端侧第一验证信息。处理模块，还用于判断终端侧第一验证信息与网络侧第一验证信息是否一致。在终端侧第一验证信息与网络侧第一验证信息一致的情况下，处理模块，还用于根据根密钥、真实签约永久标识和终端侧计数器值，生成终端侧第二验证信息。收发模块，还用于向接入和移动性管理功能发送N1消息。
其中，非接入层安全模式命令消息包括鉴权成功消息、网络侧第一验证信息和网络侧计数器值，鉴权成功消息用于指示对通信装置鉴权成功。真实签约永久标识包括真实用户名信息，真实用户名信息用于标识通信装置。N1消息包括终端侧第二验证信息和终端侧计数器值。
在一种可能的设计方式中，处理模块，还用于根据根密钥，生成中间密钥，根据中间密钥、真实签约永久标识和网络侧计数器值，生成终端侧第一验证信息。
需要说明的是，第十三方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自接入和移动性管理功能、和/或其他网元的数据和/或信令；发送模块用于向接入和移动性管理功能和/或其他网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第十三方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十三方面所述的通信装置可以执行第六方面所述的方法。
需要说明的是，第十三方面所述的通信装置可以是终端设备，也可以是可设置于终端设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十三方面所述的通信装置的技术效果可以参考第六方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第十四方面，提供一种通信装置。该通信装置，包括：接收模块和发送模块。其中，接收模块，用于接收来自终端设备的注册请求消息。发送模块，还用于向鉴权服务器功能发送鉴权认证请求消息。接收模块，还用于接收来自鉴权服务器功能的鉴权认证响应消息。发送模块，还用于在与终端设备成功执行非接入层安全模式命令流程的情况下，向鉴权服务器功能发送鉴权认证结果消息。
其中，注册请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息、匿名用户名信息和路由指示符，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识，匿名用户名信息为缺省值。鉴权认证请求消息包括匿名签约 隐藏标识。鉴权认证响应消息包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权认证结果消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
需要说明的是，接收模块和发送模块可以分开设置，也可以集成在一个模块中，即收发模块。本申请对于接收模块和发送模块的具体实现方式，不做具体限定。
可选地，第十四方面所述的通信装置还可以包括处理模块和存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十四方面所述的通信装置可以执行第七方面所述的方法。
需要说明的是，第十四方面所述的通信装置可以是接入和移动性管理功能，也可以是可设置于接入和移动性管理功能的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十四方面所述的通信装置的技术效果可以参考第七方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第十五方面，提供一种通信装置。该通信装置，包括：处理模块和收发模块。其中，收发模块，用于接收来自鉴权服务器功能的认证请求消息。收发模块，还用于接收来自外部鉴权设备的协议响应消息。处理模块，用于判断匿名域信息与真实域信息是否匹配，在真实域信息与匿名域信息匹配的情况下，收发模块，还用于向鉴权服务器功能发送认证响应消息。其中，认证请求消息可以包括匿名签约永久标识。匿名签约永久标识包括匿名域信息。协议响应消息可以包括真实签约永久标识，还可以包括鉴权成功消息、和/或根密钥。认证响应消息可以包括鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
在一种可能的设计方式中，匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。
需要说明的是，第十五方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自鉴权服务器功能、外部鉴权设备和/或其他网元的数据和/或信令；发送模块用于向鉴权服务器功能、外部鉴权设备和/或其他网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第十五方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十五方面所述的通信装置可以执行第八方面所述的方法。
需要说明的是，第十五方面所述的通信装置可以是网络切片和独立非公共网络特定的鉴权和授权功能，也可以是可设置于网络切片和独立非公共网络特定的鉴权和授权功能的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十五方面所述的通信装置的技术效果可以参考第八方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第十六方面，提供一种通信装置。该通信装置包括：处理器，该处理器与存储器耦合，存储器用于存储计算机程序。
处理器用于执行存储器中存储的计算机程序，以使得如第二方面至第八方面中任 一种可能的实现方式所述的通信方法被执行。
在一种可能的设计中，第十六方面所述的通信装置还可以包括收发器。该收发器可以为收发电路或输入/输出端口。所述收发器可以用于该通信装置与其他设备通信。
需要说明的是，输入端口可用于实现第二方面至第八方面所涉及的接收功能，输出端口可用于实现第二方面至第八方面所涉及的发送功能。
在本申请中，第十六方面所述的通信装置可以为接入和移动性管理功能、鉴权服务器功能、统一数据管理、网络切片和独立非公共网络特定的鉴权和授权功能或终端设备，或者设置于接入和移动性管理功能、鉴权服务器功能、统一数据管理、网络切片和独立非公共网络特定的鉴权和授权功能或终端设备内部的芯片或芯片系统。
此外，第十六方面所述的通信装置的技术效果可以参考第二方面至第八方面中任一种实现方式所述的通信方法的技术效果，此处不再赘述。
第十七方面，提供了一种芯片系统，该芯片系统包括逻辑电路和输入/输出端口。其中，逻辑电路用于实现第二方面至第八方面所涉及的处理功能，输入/输出端口用于实现第二方面至第八方面所涉及的收发功能。具体地，输入端口可用于实现第二方面至第八方面所涉及的接收功能，输出端口可用于实现第二方面至第八方面所涉及的发送功能。
在一种可能的设计中，该芯片系统还包括存储器，该存储器用于存储实现第二方面至第八方面所涉及功能的程序指令和数据。
该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
第十八方面，提供一种计算机可读存储介质，包括：计算机程序或指令；当该计算机程序或指令在计算机上运行时，使得第二方面至第八方面中任意一种可能的实现方式所述的通信方法被执行。
第十九方面，提供一种计算机程序产品，包括计算机程序或指令，当该计算机程序或指令在计算机上运行时，使得第二方面至第八方面中任意一种可能的实现方式所述的通信方法被执行。
附图说明
图1为本申请实施例提供的一种通信系统的架构示意图；
图2为本申请实施例提供的一种SNPN网络的架构示意图；
图3为本申请实施例提供的一种NAS SMC流程示意图；
图4为本申请实施例提供的一种通信方法的流程示意图；
图5为本申请实施例提供的另一种通信方法的流程示意图；
图6为本申请实施例提供的又一种通信方法的流程示意图；
图7为本申请实施例提供的又一种通信方法的流程示意图；
图8为本申请实施例提供的一种通信装置的结构示意图；
图9为本申请实施例提供的另一种通信装置的结构示意图；
图10为本申请实施例提供的又一种通信装置的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如通用移动通信系统 (universal mobile telecommunications system，UMTS)、无线局域网(wireless local area network，WLAN)、无线保真(wireless fidelity，Wi-Fi)系统、有线网络、车到任意物体(vehicle to everything，V2X)通信系统、设备间(device-to-device，D2D)通信系统、车联网通信系统、第4代(4th generation，4G)移动通信系统，如长期演进(long term evolution，LTE)系统、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统，第五代(5th generation，5G)移动通信系统，如新空口(new radio，NR)系统，以及未来的通信系统，如第六代(6th generation，6G)移动通信系统等。
本申请将围绕可包括多个设备、组件、模块等的系统来呈现各个方面、实施例或特征。应当理解和明白的是，各个系统可以包括另外的设备、组件、模块等，并且/或者可以并不包括结合附图讨论的所有设备、组件、模块等。此外，还可以使用这些方案的组合。
另外，在本申请实施例中，“示例地”、“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
本申请实施例中，“的(of)”，“相应的(corresponding，relevant)”和“对应的(corresponding)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
本申请实施例中，有时候下标如W1可能会笔误为非下标的形式如W 1，在不强调其区别时，其所要表达的含义是一致的。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为便于理解本申请实施例，首先以图1中示出的通信系统为例详细说明适用于本申请实施例的通信系统。示例性地，图1为本申请实施例提供的通信方法所适用的一种通信系统的架构示意图。
如图1所示，该通信系统包括终端设备和核心网网元。其中，核心网网元的数量可以为一个或多个。可选地，该通信系统还可以包括外部鉴权设备。外部鉴权设备的数量可以为一个或多个。当外部鉴权设备为多个的时候，每一个外部鉴权设备备所属的网络也各不相同。
其中，上述终端设备为接入上述通信系统，且具有无线收发功能的终端或可设置于该终端的芯片或芯片系统。该终端设备也可以称为用户设备(user equipment，UE)、用户装置、接入终端、用户单元、用户站、移动站、移动台(mobile station，MS)、远方站、远程终端、移动设备、用户终端、终端、终端单元、终端站、终端装置、无线通信设备、用户代理或用户装置。
例如，本申请的实施例中的终端设备可以是手机(mobile phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、膝上型电脑(laptop computer)、平板电脑(Pad)、无人机、带无线收发功能的电脑、机器类型通信(machine type  communication，MTC)终端、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、物联网(internet of things，IoT)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端(例如游戏机、智能电视、智能音箱、智能冰箱和健身器材等)、车载终端、具有终端功能的RSU。接入终端可以是蜂窝电话(cellular phone)、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备(handset)、计算设备或连接到无线调制解调器的其它处理设备、可穿戴设备等。
又例如，本申请实施例中的终端设备可以是智慧物流中的快递终端(例如可监控货物车辆位置的设备、可监控货物温湿度的设备等)、智慧农业中的无线终端(例如可收集禽畜的相关数据的可穿戴设备等)、智慧建筑中的无线终端(例如智慧电梯、消防监测设备、以及智能电表等)、智能医疗中的无线终端(例如可监测人或动物的生理状态的可穿戴设备)、智能交通中的无线终端(例如智能公交车、智能车辆、共享单车、充电桩监测设备、智能红绿灯、以及智能监控以及智能停车设备等)、智能零售中的无线终端(例如自动售货机、自助结账机、以及无人便利店等)。又例如，本申请的终端设备可以是作为一个或多个部件或者单元而内置于车辆的车载模块、车载模组、车载部件、车载芯片或者车载单元，车辆通过内置的所述车载模块、车载模组、车载部件、车载芯片或者车载单元可以实施本申请提供的方法。
可选的，图1所示的通信系统可以适用于目前正在讨论的通信网络，也可以适用于未来的其他网络等，本申请实施例对此不做具体限定。
示例性的，图1所示的通信系统应用于独立非公共网络(stand-alone non-public network，SNPN)网络为例，如图2所示，SNPN网络可以包括终端设备、核心网网元、AAA服务器、(无线)接入网((radio)access network，(R)AN)设备、和数据网络(data network，DN)。
关于终端设备的实现方式可参照上述图1中对终端设备的阐述。可选地，终端设备可存储有长期密钥和相关函数。终端设备在与核心网网元(如AMF网元、AUSF网元等)进行双向鉴权的时候，可以使用长期密钥和相关函数验证网络的真实性。
例如，核心网网元可以包括但不限于如下一项或多项：用户面功能(user plane function，UPF)网元、接入和移动性管理功能(core access and mobility management function，AMF)/安全锚功能(security anchor function，SEAF)网元、会话管理功能(session management function，SMF)网元、鉴权服务器功能(authentication server function，AUSF)网元、网络切片选择功能(network slice selection function，NSSF)网元、网络开放功能(network exposure function，NEF)网元、网络功能存储功能(network exposure function Repository Function，NRF)、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元、应用功能(application function，AF)网元、和网络切片和独立非公共网络特定的鉴权和授权功能(network  slice-specific and SNPN authentication and authorization function，NSSAAF)网元。其中，终端设备通过RAN设备接入5G网络，终端设备通过N1接口(简称N1)与AMF通信；RAN设备可以通过N2接口(简称N2)与AMF通信；RAN设备可以通过N3接口(简称N3)与UPF通信；SMF通过N4接口(简称N4)与UPF通信，UPF通过N6接口(简称N6)接入数据网络。
此外，图2所示的AUSF、AMF/SEAF、SMF、NSSF、NEF、NRF、PCF、UDM、NSSAAF或者AF等控制面功能采用服务化接口进行交互。比如，AUSF对外提供的服务化接口为Nausf，AMF与SEAF可以合设，AMF对外提供的服务化接口为Namf；SMF对外提供的服务化接口为Nsmf；NSSF对外提供的服务化接口为Nnssf；NEF对外提供的服务化接口为Nnef；NRF对外提供的服务化接口为Nnrf；PCF对外提供的服务化接口为Npcf；UDM对外提供的服务化接口为Nudm；NSSAAF对外提供的服务化接口为Nnssaaf，AF对外提供的服务化接口为Naf。
其中，AMF网元主要负责信令处理部分，例如接入控制、移动性管理、附着与去附着以及网关选择等功能。AMF网元为终端设备中的会话提供服务的情况下，可以为该会话提供控制面的存储资源，以存储会话标识、与会话标识关联的SMF网元标识等。AMF还可以获得5G NAS安全上下文，5G NAS安全上下文用于保护NAS消息。
SMF网元负责用户面网元选择，用户面网元重定向、因特网协议(internet protocol，IP)地址分配、承载的建立、修改和释放以及服务质量(quality of service，QoS)控制等。
UPF网元负责终端设备中用户数据的转发和接收。UPF网元可以从数据网络接收用户数据，通过RAN设备传输给终端设备；UPF网元还可以通过RAN设备从终端设备接收用户数据，转发到数据网络。UPF网元中为终端设备提供服务的传输资源和调度功能由SMF网元管理控制的。
AUSF网元可支持3GPP和非3GPP的接入认证。NSSF网元主要负责网络切片的选择，可以根据终端设备的切片选择辅助信息、签约信息等确定终端设备允许接入的网络切片实例，可用于网络验证UE是否是真实的。在内部鉴权场景中，AUSF网元可以对终端设备进行鉴权。
NEF网元主要支持3GPP网络和第三方应用安全的交互。NRF网元可以支持网络功能的注册和发现。PCF网元负责策略控制的决策，可提供控制平面功能的策略规则，以及基于流量的计费控制功能。
UDM网元主要负责终端设备的签约数据管理，包括终端设备标识的存储和管理、终端设备的接入授权等。
AF网元主要支持与3GPP核心网交互来提供服务，例如影响数据路由决策、策略控制功能或者向网络侧提供第三方的一些服务。
NSSAAF网元主要作用是与外部AAA服务器连接，做一个服务化接口(service based interface，SBI)接口与AAA接口转换的作用，是一个连接3GPP网络内部网元与外部AAA服务器的中间网元。比如，NSAAF预配置有AAA服务器的地址信息与域信息的对应关系，当NSSAAF收到域信息后，NSAAF可以根据AAA服务器的地址信息确定AAA服务器，然后将收到的消息发送给AAA服务器。再比如，NSSAAF可 以根据域信息向网域名称服务器(domain name server,DNS)服务器请求AAA服务器的地址信息，并从DNS服务器获得AAA服务器地址信息，然后将收到的消息发送给AAA服务器。
上述图1中所示的外部鉴权设备可以为图2中所示的AAA服务器，外部鉴权设备可以称为AAA服务器、或鉴权服务器等，外部鉴权设备可存储用户信任状，信任状可用于对终端设备的身份进行鉴权。外部鉴权设备可用于处理终端设备的访问请求，提供验证授权以及帐户服务，管理用户访问网络服务器，对具有访问权的终端设备提供服务。
上述接入网设备为位于上述通信系统的网络侧，且具有无线收发功能的设备或可设置于该设备的芯片或芯片系统。该接入网设备包括但不限于：无线保真(wireless fidelity，Wi-Fi)系统中的接入点(access point，AP)，如家庭网关、路由器、服务器、交换机、网桥等，演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(baseband unit，BBU)，无线中继节点、无线回传节点、传输点(transmission and reception point，TRP或者transmission point，TP)等，还可以为5G，如，新空口(new radio，NR)系统中的gNB，或，传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)、具有基站功能的路边单元(road side unit，RSU)等，或者还可以为卫星、或未来各种形式的基站。
需要说明的是，本申请实施例提供的通信方法，可以适用于图1、图2所示的任意两个节点之间，如终端设备与核心网网元之间、多个核心网网元之间，以及核心网网元与AAA服务器之间，具体实现可以参考下述方法实施例，此处不再赘述。
应当指出的是，本申请实施例中的方案还可以应用于其他通信系统中，相应的名称也可以用其他通信系统中的对应功能的名称进行替代。
应理解，图1仅为便于理解而示例的简化示意图，该通信系统中还可以包括其他网络设备，和/或，其他终端设备，图1中未予以画出。
为了使得本申请实施例更加清楚，以下对与本申请实施例中相关的部分内容以及概念作统一介绍。
第一，签约隐藏标识(subscription concealed identifier，SUCI)、签约永久标识(subscription permanent identifier，SUPI)：
本申请包括两类SUCI：真实签约隐藏标识(可简称为真实SUCI)和匿名签约隐藏标识(可简称为匿名SUCI)，以及包括两类SUPI：真实签约永久标识(可简称为真实SUPI)和匿名签约永久标识(可简称为匿名SUPI)。
需要说明的是，可以将真实签约隐藏标识称为真实签约用户隐藏标识、或非匿名化签约用户隐藏标识等，可以将匿名签约隐藏标识称为匿名签约用户隐藏标识等，类似地，可以将真实签约永久标识称为真实签约用户永久标识、或非匿名化签约用户永久标识等，将匿名签约永久标识称为匿名签约用户永久标识等，本申请对此相关的名 称不进行限定。
真实SUCI可以是终端设备根据预配置的公钥对真实SUPI进行加密和完整性保护后生成的。当终端设备没有预配置的公钥时，终端设备可以使用空机制(null-scheme)生成真实SUCI。
示例性地，SUCI的格式可以包括网络访问标识符(network access identifier，NAI)格式、和国际移动客户识别码(international mobile subscriber identity，IMSI)格式。示例性地，SUPI的格式可以包括NAI格式、和IMSI格式等格式。
其中，若SUPI的格式是IMSI格式，其对应的SUCI的格式可以为IMSI格式，也可以为NAI格式，这与具体应用场景有关。若SUPI的格式不是IMSI格式，其对应的SUCI的格式可以为NAI格式。
一些实施例中，真实SUCI可以包括用户名信息和域信息。真实SUPI可以包括用户名信息和域信息。匿名SUCI可以只包括域信息，可选的，还可以包括用户名信息。匿名SUPI可以只包括域信息，可选的，还可以包括用户名信息。针对同一个终端设备/用户而言，其真实SUCI、真实SUPI、匿名SUPI以及匿名SUCI包括的域信息都是相同的，并且他们的用户名信息一般是不同的(格式不同和/或信息表征的含义不同)。具体的，真实SUCI与真实SUPI中包括的用户名信息都可以标识终端设备，但是他们的格式可能是不同的(详细可以参考TS23.003 28.7.2和28.7.3)，例如真实SUCI中的用户名信息可以是由真实SUPI中的用户名信息映射得到的。匿名SUCI与真实SUCI/真实SUPI中的用户名信息一般是不同的。匿名SUCI与匿名SUPI的关系参考本申请下面实施例的描述。
为了便于表述，在本申请下述实施例中，匿名域信息指在匿名SUPI、或匿名SUCI中携带的域信息。真实域信息指在真实SUPI、或真实SUCI中携带的域信息。匿名用户信息指在匿名SUPI、或匿名SUCI中携带的用户信息。真实用户信息指在真实SUPI、或真实SUCI中携带的用户信息。
具体的，匿名SUCI的用户名信息可以包括如下一项或多项：路由指示符(routing indicator，RID)、功能信息和缺省值。其中，RID信息可以为缺省值、或不是缺省值。
其中，域信息可以包括用户的家乡网络信息，可用于相关网元/功能实体确定用户名信息对应的签约数据所在网络。例如，域信息指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。真实用户名信息可用于标识终端设备，例如指示终端设备的唯一身份。匿名用户名信息则可以用于传递一些必要信息，或者用于确保匿名SUCI/匿名SUPI与真实SUCI/真实SUCI拥有相同的格式，以便于网络侧解析匿名SUCI/匿名SUPI。比如，网络侧可以根据SUCI中的用户名信息得出一个SUCI是匿名SUCI还是真实SUCI。
具体地，当匿名SUCI为NAI格式的时候，即username@realm格式时，其中username(用户名信息)部分可以包括如下一项或多项：RID信息、功能信息和缺省值。
在RID信息不是缺省值的情况下，AMF网元可以根据RID信息确定AUSF网元，AUSF网元可以根据RID信息确定UDM网元。在RID信息是缺省值的情况下，AMF网元或者AUSF网元向NRF网元请求AUSF网元或UDM网元，NRF网元返回RID 信息为缺省值对应的AUSF网元或者UDM网元。
示例性地，功能信息可以指示该匿名SUCI的使用场景、和/或指示是真实SUCI还是匿名SUCI。例如应用于外部鉴权设备对终端设备进行鉴权的场景、或应用于SNPN网络等。例如，匿名SUCI可以是如下格式：SNPN@realm、或外部@realm、或ANY@realm、或匿名@realm。匿名(anonymous，ANY)用于表示该SUCI是匿名SUCI。
示例性地，缺省值可用于补充代表真实身份的相关比特位。比如，真实SUCI的username构成为type<supi type>.rid<routing indicator>.schid<protection scheme id>.userid<MSIN or Network Specific Identifier SUPI username>，那么缺省值用于填充userid部分。
例如，NAI格式的真实SUPI可以为234150999999999@wlan.mnc015.mcc234.3gppnetwork.org，其中，wlan.mnc015.mcc234.3gppnetwork.org为用户的家乡网络信息。可选地，匿名SUCI可以不包括用户名信息，则匿名SUCI为域信息(realm)，也可以包括域信息部分和@符号，比如@realm。例如匿名SUCI可以为@wlan.mnc015.mcc234.3gppnetwork.org或者wlan.mnc015.mcc234.3gppnetwork.org(即不包括@符号)。在匿名SUCI不包括用户名信息的情况下，匿名化的SUCI具体可以是使用空机制生成的真实SUCI后，只保留真实SUCI的realm部分构成的SUCI。
匿名SUCI也可以包括匿名用户名信息，该匿名用户信息可以设置为缺省值。例如匿名SUCI可以为000000000000000@wlan.mnc015.mcc234.3gppnetwork.org(即用户名信息部分全部填充为等量比特位的缺省值0，当前也可以填充为约定好的其他缺省值)。
一些实施例中，构成匿名SUCI的信息(RID信息、功能信息和/或缺省值)可以相互结合，当他们结合的时候，可以使用连接符，也可以不使用连接符。例如，匿名SUCI可以为SNPNRID@realm等，例如RID信息和缺省值结合的情况下，匿名SUCI可以为RID@realm。例如功能信息和缺省值结合的情况下，匿名SUCI可以为SNPN@realm。例如，当连接符为“.”的时候，匿名SUCI可以为SNPN.RID@realm。本申请不一一列举。
一些实施例中，匿名SUPI包括的用户名信息可以包括如下一项或多项：RID信息、功能信息、计数器值和缺省值。其中，RID信息可以为缺省值、或不是缺省值。
例如，NAI格式的匿名SUPI可以为RID@realm。
示例性地，功能信息可以指示该匿名SUPI的使用场景、和/或指示SUPI是真实SUPI还是匿名SUPI，例如应用于外部鉴权设备对终端设备进行鉴权的场景、或应用于SNPN网络等。例如，NAI格式的匿名SUPI可以为SNPN@realm、或外部@realm、或ANY@realm、或匿名@realm等。ANY用于表示该SUPI是匿名SUPI。
示例性地，计数器值可以是计数器的值，计数器值可以为大于或等于0的整数，可以使用计数器值对匿名SUPI进行标识。例如可以为所有的家乡网络维护一个计数器，这样可以为不同家乡网络分配不同的匿名SUPI；或者，可以为每一个家乡网络维护一个计数器，这样可以做到更细粒度，只需要确保同一个家乡网络的匿名SUPI的唯一性。本申请不限定计数器数值的大小或者长度，比如计数器可以由32bit构成，最 终可以输出一个整数，或者输出一个32bit的二进制数字。计数器的其初始值为0，每次使用后加1。
例如，所有的家乡网络维护一个计数器时，匿名SUPI可以为0@realm#1，1@realm#2，3@realm#1，其中realm#1和realm#2代表2个不同的家乡网络，这3个计数器值则代表先为realm#1的网络分配了计数器值为0的匿名SUPI，又为realm#2的网络分配了计数器值为1的匿名SUPI，最后为realm#1的网络分配了计数器值为3的匿名SUPI。再例如，当每一个家乡网络维护一个计数器的时候，匿名SUPI可以为0@realm#1，0@realm#2，1@realm#1，其中realm#1和realm#2代表2个不同的家乡网络，这3个计数器值则代表先为realm#1的网络分配了计数器值为0的匿名SUPI，又为realm#2的网络分配了计数器值为0的匿名SUPI，最后为realm#1的网络分配了计数器值为1的匿名SUPI。
示例性地，匿名SUPI的用户名信息可以为缺省值。缺省值，可用于补充代表真实身份的相关比特位。例如NAI格式的匿名SUPI可以为username@realm。其中，username部分为缺省值。比如，缺省值可以为0，则此时匿名化SUPI的格式为0@realm，或者00000000@realm。其中00000000代表username有8个数字构成。本申请例不限定0的个数。
一些实施例中，构成匿名SUPI的信息(RID信息、功能信息、计数器值和/或缺省值)可以相互结合，当他们结合的时候，可以使用连接符，也可以不使用连接符。例如，匿名SUPI可以为SNPNRID@realm、1RID@realm、2SNPN@realm等，例如RID信息和缺省值结合的情况下，匿名SUPI可以为RID@realm。例如功能信息和缺省值结合的情况下，匿名SUPI可以为SNPN@realm。例如，当连接符为“.”的时候，匿名SUPI可以为SNPN.RID@realm、SNPN.RID.1@realm、SNPN.1.RID@realm、SNPN.2@realm、ANY.1@relam、SNPN.ANY.1@realm。本申请不一一列举。
第二，鉴权方式、和鉴权设备：
示例性地，鉴权方式指鉴权设备对终端设备进行鉴权的方式。其中，鉴权方式可以包括外部鉴权方式、或者内部鉴权方式。鉴权设备可以分为外部鉴权设备、和内部鉴权设备。
例如，外部鉴权方式可以指通过外部鉴权设备对终端设备进行鉴权的方式。其中，外部鉴权设备与为该终端设备提供网络服务的AUSF网元属于不同的网络，例如AAA服务器。
例如，内部鉴权方式可以指通过内部鉴权设备对终端设备进行鉴权的方式。其中，内部鉴权设备与终端设备属于同一网络，例如AUSF网元。
第三，鉴权成功消息、和鉴权结果指示信息：
示例性地，鉴权成功消息可用于指示对终端设备鉴权成功。在本申请中，外部鉴权设备对终端设备鉴权成功后，生成鉴权成功消息，通过NSSAAF发给AUSF，例如可扩展身份认证协议(extensible authentication protocol，EAP)成功(success)消息。
示例性地，鉴权结果指示信息用于指示对终端设备鉴权成功或失败，例如网络侧认为终端设备是真实的情况下(例如外部鉴权设备进行鉴权的过程中所使用的真实签约永久标识与终端设备侧的真实签约永久标识相同，再例如，AUSF根据鉴权成功消 息确定，再例如，AUSF对终端设备鉴权成功)，AUSF生成鉴权结果指示信息。在本申请中，鉴权结果指示信息由AUSF生成并发给UDM。
鉴权结果指示信息与鉴权成功消息的格式或表现形式不同。鉴权结果指示信息可以是UDM能够识别的信息格式，例如使用“1”来表征鉴权成功。
第四，网络侧第一验证信息、网络侧第二验证信息、终端侧第一验证信息、终端侧第二验证信息：
网络侧第一验证信息、网络侧第二验证信息、终端侧第一验证信息、终端侧第二验证信息中的“网络侧”指由网络侧的网元(例如AUSF)确定的，“终端侧”指由终端设备确定的，“第一”、“第二”等字样并不对数量和执行次序进行限定。
例如，网络侧第一验证信息、和网络侧第二验证信息是由AUSF确定的验证信息。终端侧第一验证信息、和终端侧第二验证信息是由终端设备确定的验证信息。具体确定方法可参照下述图5所示的通信方法。
本申请通过终端设备判断网络侧第一验证信息与终端侧第一验证信息是否一致，来确定网络侧是否是真实的，若相同，则终端设备认为网络侧是真实的。通过AUSF判断终端侧第二验证信息与网络侧第二验证信息是否一致，来确定终端设备是否是真实的，若是，则AUSF认为终端设备是真实的。如此，可以完成终端设备与网络侧的双向认证。
或者，终端设备可以通过是否接收到鉴权成功消息，来确定网络侧是否是真实的，若收到鉴权成功消息则终端设备认为网络侧是真实的，鉴权成功消息指示对终端设备成功鉴权。采用此种方式的情况下，可以不执行AUSF生成网络侧第一验证信息、以及终端设备生成终端侧第一验证信息并比较是否一致的步骤。结合AUSF判断终端侧第二验证信息与网络侧第二验证信息是否一致，可以完成终端设备与网络侧的双向认证。
本申请提出终端设备与网络侧相互认证的方案。
例如，可以通过匿名SUPI的域信息部分与真实SUPI的域信息部分是否匹配，来确定匿名SUPI与真实SUPI的域信息部分是否相同，然后通过根据真实SUPI生成中间密钥来判断用户名信息是否相同。
其中，匹配指域信息部分完全相同、或域信息部分之间存在映射关系。例如，匿名SUPI的域信息部分为FQDN#1，真实SUPI的域信息部分为FQDN#2，FQDN#1与FQDN#2映射或关联或相同，则认为FQDN#1与FQDN#2匹配，因此该匿名SUPI与真实SUPI相同。
又例如，通过判断终端侧的验证信息与网络侧的验证信息是否相同，来实现终端设备与网络侧相互认证。其中，终端侧的验证信息是根据真实SUPI与密钥确定的，网络侧的验证信息是根据网络侧鉴权过程中使用的信任状对应的真实SUPI与的密钥确定的，若终端侧的验证信息与网络侧的验证信息相同，则说明网络侧鉴权过程中使用的信任状对应的真实SUPI与终端的真实SUPI相同，如此，可以完成终端设备与网络侧的双向认证，终端设备认为网络是真实的，网络认为终端设备是真实的。
再例如，通过在鉴权流程后执行非接入层(non-access stratum，NAS)安全模式命令(security mode command，SMC)流程，来实现终端设备与网络侧相互认证。在 鉴权流程后执行NAS SMC流程，若NAS SMC流程成功，可得出网络侧鉴权过程中使用的信任状对应的真实SUPI与终端的真实SUPI相同，具体可参照下述第五和第六的阐述。
第五，密钥Kamf的生成：
示例性地，密钥Kamf可以是根据密钥Kseaf生成的，并且以参数FC、P0、L0、L1等作为密钥派生函数(key derivation function，KDF)的输入，Kseaf的长度可以为256比特。其中，密钥Kseaf可以是根据密钥Kausf生成的。
例如，FC＝0x6D，P0＝IMSI或NAI或GCI或GLI，L0表示P0的长度，L1表示P1的长度。
其中，P0表示真实SUPI的值(value)，SUPI的值作为输入参数，参与密钥Kamf的生成。SUPI＝SUPI的类型+SUPI的值。SUPI的值包括IMSI，NAI，GCI和GLI。SUPI的类型包括IMSI类型和NSI类型。P0中展示的含义是只使用SUPI的值，不包括SUPI的类型。
由此得出，SUPI中的SUPI的值参与密钥Kamf的生成的。
第六，NAS SMC流程：
图3为本申请实施例提供的一种NAS SMC流程示意图。
如图3所示，该通信方法包括如下步骤：
S301，AMF网元开启完整性保护。
S302，AMF网元向终端设备发送NAS SMC消息。相应地，终端设备接收来自AMF网元的NAS SMC消息。
示例性地，NAS SMC消息可以包括：密钥标识符(例如5G密钥标识符(key set identifier in 5G，5G ngKSI))、和/或终端设备的能力信息等信元。
例如，NAS SMC消息指示采用密钥标识符对应的密钥进行安全保护。
S303，AMF网元开启上行解密保护。
S304，AMF网元开启下行加密保护。
S305，终端设备进行NAS SMC完整性保护验证。
S306，在完整性保护验证成功后，终端设备向AMF网元发送NAS安全模式完成(security mode complete，SMP)消息。相应地，AMF网元接收来自终端设备的NAS SMP消息。
示例性地，NAS SMC流程可用于激活密钥。在本申请中，NAS SMC流程可发生在主鉴权流程(见下述S409)后。主鉴权流程中AMF网元和终端设备可以生成新的密钥Kausf(例如在下述S705生成)，SUPI中的SUPI的值参与密钥Kamf的生成的。根据密钥Kausf生成密钥Kseaf，进一步根据密钥Kseaf生成密钥Kamf，并根据该新的Kausf生成新的NAS密钥(例如，完整性保护密钥KNASint、加密保护密钥KNASenc)。新的NAS密钥通过NAS SMC流程被激活。AMF网元对NAS SMP消息完整性验证、以及解密NAS SMP消息成功的情况下，确定与终端设备成功执行NAS SMC流程。
当终端设备侧的NAS密钥与AMF网元侧的NAS密钥相同时，NAS SMC流程才能成功完成，由此可以得出：因为NAS SMC流程成功，所以终端设备和AMF网元拥有相同的真实SUPI，AMF网元侧的真实SUPI是从AUSF网元接收的(见下述S703)， 因而终端设备侧的真实SUPI与AUSF网元侧的真实SUPI相同。
在主鉴权流程中，AMF网元可以生成一个密钥标识符ngKSI(例如在下述S704生成)。AMF网元可以NAS SMC流程的NAS SMC消息中携带该ngKSI。
在现有技术中，在主鉴权流程后不一定执行NAS SMC流程，因此意味着，虽然在主鉴权流程生成了新的密钥Kausf，但是由于没有执行NAS SMC流程，从而不会激活新的密钥Kausf，不会使用新的密钥，此时终端设备和AMF网元继续使用当前使用的密钥。
需要说明的是，当前使用的密钥不一定是前一次主鉴权流程中生成的密钥，因为前一次主鉴权流程后不一定执行NAS SMC流程。
从而，当前使用的密钥与是否执行主鉴权流程没有直接关系，而是与是否执行NAS SMC流程有关，并与NAS SMC消息中携带的密钥标识符有关。
下面将结合图4-图7对本申请实施例提供的通信方法进行具体阐述。图4-图7以图2所示的AUSF、AMF、UDM、NSSAAF为例进行阐述，本申请提供的通信方法还可以应用于其他、以及未来各种形式的网络架构中，相应的名称也可以用其他网络架构、以及未来各种形式的网络架构中的对应功能的名称进行替代。
示例性地，图4为本申请实施例提供的一种通信方法的流程示意图。
如图4所示，该通信方法包括如下步骤：
S401，AUSF向UDM发送鉴权获取请求消息。相应地，UDM接收来自AUSF的鉴权获取请求消息。
示例性地，鉴权获取请求消息可以包括匿名签约隐藏标识。
例如，匿名签约隐藏标识包括匿名域信息，匿名域信息可用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。可选地，匿名签约隐藏标识还可以包括匿名用户名信息和路由指示符，其中，匿名用户名信息为缺省值。匿名签约隐藏标识具体实现方式可参照上述对匿名SUCI的阐述，此处不再赘述。
一些实施例中，在RID信息不是缺省值的情况下，AUSF可以根据RID信息向UDM发送鉴权获取请求消息。
在一种可能的设计方式中，本申请实施例提供的通信方法还可以包括：S405，在未获得公钥的情况下，终端设备确定匿名签约隐藏标识。
也就是说，匿名签约隐藏标识是终端设备确定的。
示例性地，终端设备确定其通用用户身份识别模块(universal subscriber identity module，USIM)或者移动设备(mobile equipment，ME)上存储的RID信息是否为缺省值，若是，则生成的匿名签约隐藏标识可以不包括RID信息，若不是，则生成的匿名签约隐藏标识中携带有RID信息，如RID@realm。
例如，匿名签约隐藏标识中不包括RID信息，则AMF或者AUSF向NRF请求AUSF或UDM,NRF返回RID信息为缺省值对应的AUSF或者UDM。
如此，RID信息是为了选择AUSF或UDM设置的。RID信息可以预置在USIM卡或终端设备中，还可以由UDM通过空中协议(over the air，OTA)或者通过其他流程下发给终端设备。在SNPN的外部鉴权场景下，SNPN网络可以为不同的终端设备预置不同的RID信息。比如，为信任状存储在SNPN网络的UDM中的终端设备，提 供RID#1，为使用外部认证，即使用外部鉴权设备的终端设备提供RID#2，此时外部信息存鉴权对端设备鉴权的时使用的终信任状。
RID#1和RID#2可以选择到的AUSF和UDM是不同的。具体地，根据RID#1可以选择AUSF#1和UDM#1，根据RID#2可以选择AUSF#2和UDM#2。AUSF#1和AUSF#2可以是2个不同的实例(instance)，或者2个不同的功能实体。UDM#1和UDM#2同理。这样做可以使内外部使用的网元做到安全隔离，避免同一个AUSF和/或UDM既为内部服务，又为外部服务。同一个AUSF和/或UDM既为内部服务，又为外部服务，可能面临增大攻击面的风险。比如攻击者可以随意构造匿名SUCI，不停的发起鉴权流程，占用AUSF的资源。最终可能导致该AUSF资源耗尽，既无法为内部服务，又无法为外部服务。在安全隔离的情况下，攻击者不会影响到为内部服务的AUSF的资源，因此该SNPN网络依然可以很好的为内部用户服务。
在一种可能的设计方式中，本申请实施例提供的通信方法还可以包括：S406，终端设备向AMF发送注册请求消息。相应地，AMF接收来自终端设备的注册请求消息。
例如，结合图2，AMF可以为AMF/SEAF。本申请以AMF为例进行阐述。
可选地，注册请求消息可以包括匿名签约隐藏标识。
示例性地，注册请求消息可用于请求到SNPN网络的注册流程。
在一种可能的设计方式中，本申请实施例提供的通信方法还可以包括：S407，AMF向AUSF发送鉴权认证请求消息。相应地，AMF接收来自AUSF的鉴权认证请求消息。
可选地，鉴权认证请求消息可以包括匿名签约隐藏标识。
也就是说，匿名签约隐藏标识可以是终端设备经由AMF发送给AUSF的。
可选地，鉴权认证请求消息还可以包括服务网络(serving network，SN)名称(name)。
例如，SN名称表示AMF所在的网络，UDM在对终端设备鉴权时可将SN名称作为一个输入参数来使用。
一些实施例中，在RID信息不是缺省值的情况下，AMF可以根据RID信息向AUSF发送鉴权认证请求消息。
S402，UDM根据匿名域信息和配置信息，确定对终端设备进行鉴权的鉴权方式。
需要说明的是，UDM与AUSF可以是同一个网元，UDM和AUSF的功能可以由同一个网元执行，例如均由AUSF执行、或者均由NSSAAF执行。或者，在网络没有部署UDM的情况下，该功能由AUSF执行。本申请对此不进行限定，此情况下可以省略UDM和AUSF之间交互的步骤。
例如，鉴权方式可以包括外部鉴权方式或者内部鉴权方式。
示例性地，匿名域信息可用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。在匿名域信息包括多个域名的情况下，表示该SNPN网络支持与多个不同网络中的鉴权设备进行交互以对终端设备的鉴权。
示例性地，配置信息可以包括外部鉴权方式对应的一个或者多个网络的标识、和/或内部鉴权方式对应的一个或者多个网络的标识。例如，配置信息可以包括外部鉴权方式对应的一个或者多个网络的域名、和/或内部鉴权方式对应的一个或者多个网络的域名。
例如，域名的格式可以是全限定域名(fully qualified domain name，FQDN)，本 申请对此不进行限定。
再例如，配置信息中的预埋的信息的格式可以是匿名SUCI中的realm相同的格式。
可选地，配置信息中还可以包括鉴权指示信息，鉴权指示信息与网络的标识对应。例如，每一个网络的标识对应一个鉴权指示信息。又例如，多个网络的标识对应一个鉴权指示信息，如一部分网络的标识对应指示外部鉴权方式的鉴权指示信息，另一部分网络的标识对应指示内部鉴权方式的鉴权指示信息。
一些实施例中，配置信息可以存储在终端设备的签约数据中，也可以存储与网络的标识(例如域名)对应的网络的签约数据中，或者单独存储在UDM中服务于所有匿名SUCI或匿名SUPI。
UDM可选地，配置信息可以是预配置在UDM的。
示例性地，鉴权指示信息可用于指示鉴权方式。
可选地，鉴权指示信息指示鉴权方式是内部鉴权的情况下，鉴权指示信息可指示鉴权方法，鉴权指示信息还可以携带鉴权需要使用的参数，比如鉴权要使用的证书。
例如，鉴权方法用于指示具体的某一种鉴权方法。比如，鉴权方法可以包括可扩展身份认证协议传输层安全(extensible authentication protocol-transport level security，EAP-TLS)鉴权方法、和EAP隧道传输层安全(EAP-tunneled transport layer security，EAP-TTLS)鉴权方法。
在一种可能的设计方式中，上述S402可以包括下述步骤一和/或步骤二。步骤一和步骤二可以单独使用，也可以结合使用，可以先执行步骤一，再执行步骤二，或者先执行步骤二，再执行步骤一，不限定步骤一和步骤二的先后顺序。
步骤一，在能够对终端设备进行鉴权的鉴权设备所属的网络的标识与外部鉴权方式对应的一个或者多个网络的标识匹配的情况下，确定对终端设备进行鉴权的鉴权方式是外部鉴权方式；或者，在能够对设备终端设备进行鉴权的设备鉴权设备所属的网络的标识与内部鉴权方式对应的一个或者多个网络的标识匹配的情况下，确定对终端设备进行鉴权的鉴权方式是内部鉴权方式。
例如，匹配指网络的标识相同、或者网络的标识之间存在映射关系。
示例性地，配置信息存储的网络标识#1可以是网络名称#1，匿名SUCI中的匿名域信息包括网络名称1和其他信息，则可以认为配置信息存储的网络标识#1与匿名域信息相匹配。其中，网络名称#1可以理解为鉴权设备所属的网络的标识。
示例性地，配置信息存储的网络标识#1可以是网络标识符#1，网络标识符可以为字符串，表示一个外部网络的名称。配置信息包括网络名称#1和其他信息，则UDM可以确定网络名称#1与网络标识符#1之间是否可以单向或者双向映射，比如，是否可以从网络名称#1中是得到网络标识符#1，如果可以得到，则可以认为网络名称#1与网络标识符#1是匹配的。其中，网络标识#1可以理解为鉴权设备所属的网络的标识。
示例性地，配置信息包括：网络标识1、网络标识2、和网络标识3对应外部鉴权方式，网络标识4、网络标识5、和网络标识6对应内部鉴权方式，若匿名域信息包括网络标识1，则确定对终端设备进行鉴权的鉴权方式是外部鉴权方式；若匿名域信息包括网络标识5，则确定对终端设备进行鉴权的鉴权方式是内部鉴权方式。
步骤二，UDM确定匿名域信息所指示的网络的标识与UDM所属的网络的标识是 否相同。
若是，则确定对终端设备进行鉴权的鉴权方式是内部鉴权方式。
对于步骤一和步骤二结合使用的情况，以先执行步骤一再执行步骤二为例。例如，UDM执行步骤一，若能够确定出鉴权方式(例如内部鉴权、或外部鉴权)，可以不再执行步骤二；若未能够确定出鉴权方式(例如匿名域信息所指示的网络的标识与配置信息中的一个或多个网络的标识均不匹配)，则执行步骤二，若步骤二为是，则确定鉴权方式为内部鉴权，可以进一步确定鉴权方法。需要说明的是，当采用步骤一确定出鉴权方式后，仍可以执行步骤二，本申请对此不进行限定。
再例如，若匿名域信息所指示的网络的标识与配置信息中的一个或多个网络的标识均不匹配，且匿名域信息所指示的网络的标识与UDM所属的网络的标识不相同，则UDM终止鉴权流程。UDM可不处理该消息或者向AUSF发送失败消息，例如失败消息可指示注册失败。本申请实施例不做具体限制。终止鉴权流程表示该匿名化SUCI无权接入网络。
需要说明的是，先执行步骤二再执行步骤一的示例与上述先执行步骤一再执行步骤二的示例类似，可参照先执行步骤一再执行步骤二的示例，此处不再详细赘述。
一种可能的实现方式为：先执行步骤一，UDM确定匿名域信息所指示的网络的标识与UDM所属的网络的标识是否相同。若是，则确定对终端设备进行鉴权的鉴权方式是内部鉴权方式。比如，在能够对设备终端设备进行鉴权的设备鉴权设备所属的网络的标识与内部鉴权方式对应的一个或者多个网络的标识匹配的情况下，确定对终端设备进行鉴权的鉴权方式是内部鉴权方式。如不是，则再执行步骤二：在能够对终端设备进行鉴权的鉴权设备所属的网络的标识与外部鉴权方式对应的一个或者多个网络的标识匹配的情况下，确定对终端设备进行鉴权的鉴权方式是外部鉴权方式。
在一种可能的设计方式中，UDM可以根据签约隐藏标识确定对终端设备进行鉴权的方式。例如，在UDM收到的签约隐藏标识是匿名的情况下，UDM则确定用外部鉴权方式对终端设备进行鉴权。在UDM收到的签约隐藏标识是真实的情况下，UDM则确定用内部鉴权方式对终端设备进行鉴权。
S403，UDM向AUSF发送鉴权获取响应消息。相应地，AUSF接收来自UDM的鉴权获取响应消息。
示例性地，鉴权获取响应消息可以包括用于指示鉴权方式是内部鉴权还是外部鉴权的鉴权指示信息。关于鉴权指示信息的实现方式可参照上述S402，此处不再赘述。
也就是说，UDM可以向AUSF发送具体的鉴权方式，例如通过外部鉴权方式进行鉴权，或通过内部鉴权方式进行鉴权，还可以发送鉴权使用的证书信息等，或者还可以发送具体的鉴权方法，例如EAP-TLS鉴权方法、EAP-TTLS鉴权方法等。如此，AUSF可以获得鉴权方式，还可以进一步获得具体的鉴权方法和/或鉴权需要使用的参数。
在一种可能的设计方式中，鉴权获取响应消息还可以包括匿名签约永久标识。
可选地，匿名签约永久标识可以是UDM根据匿名签约隐藏标识确定的，匿名签约永久标识可以包括匿名域信息。
需要说明的是，本申请实施例不限定UDM确定匿名签约永久标识与UDM确定鉴权指示信息先后顺序。例如，可以先确定鉴权指示信息，在鉴权指示信息指示对终端 设备进行鉴权的鉴权方式是外部鉴权方式的情况下，再确定匿名签约永久标识。又例如，可以先确定匿名签约永久标识，再确定鉴权指示信息。
比如，可选地，根据匿名签约永久标识对应的签约数据确定鉴权指示信息。需要说明的是，在这种情况下，匿名签约永久标识对应的签约数据可以是以外部鉴权设备所属网络为粒度的签约数据。即，使网络的所有匿名签约永久标识在这一时刻使用相同的签约数据。
例如，匿名签约永久标识的域信息与匿名签约隐藏标识的域信息相同，例如均为匿名域信息。
在一些实施例中，匿名签约永久标识还可以包括匿名用户名信息，匿名用户名信息包括如下一项或多项：RID信息、功能信息、和计数器值、缺省值。
可选地，RID信息可以与匿名签约隐藏标识的RID信息相同。
可选地，第一功能信息可用于指示匿名签约永久标识的使用场景。
需要说明的是，匿名签约永久标识具体实现方式可参照上述对匿名SUPI的阐述，此处不再赘述。
S404，AUSF根据鉴权指示信息，向NSSAAF发送认证请求消息。相应地，NSSAAF接收来自AUSF的认证请求消息。
示例性地，认证请求消息可以用于请求对终端设备进行鉴权。
可选地，在鉴权指示信息指示鉴权方式是外部鉴权的情况下，向NSSAAF发送认证请求消息,触发NSSAAF向第一设备请求对终端设备进行鉴权；在鉴权指示信息指示鉴权方式是内部鉴权的情况下，向AMF发送认证请求消息,指示AMF对终端设备进行内部鉴权。
在一些实施例中，认证请求消息可以包括匿名签约永久标识。从而，外部鉴权设备可以通过匿名签约永久标识对终端设备进行鉴权。
在一种可能的设计方式中，上述S404可以包括下述步骤三和步骤四。
步骤三，在鉴权指示信息指示鉴权方式是外部鉴权的情况下，AUSF向NSSAAF发送认证请求消息。
也就是说，在确定采用外部鉴权的情况下，向NSSAAF发送消息，以请求对终端设备进行鉴权。
步骤四，在鉴权指示信息指示鉴权方式是内部鉴权的情况下，AUSF向AMF发送认证请求消息。
也就是说，在确定采用内部鉴权的情况下，向AMF发送消息，以开始进行外部鉴权。
需要说明的是，本申请中“步骤一”与“步骤二”等类似的描述，并不表示执行的先后顺序。
在一种可能的设计方式中，本申请实施例提供的通信方法，还可以包括：S408，NSSAAF向外部鉴权设备发送协议请求消息。相应地，外部鉴权设备接收来自NSSAAF的协议请求消息。
可选地，协议请求消息可以包括匿名签约永久标识、或者包括匿名域信息且不包括匿名签约永久标识中除匿名域信息以外的信息。
可选地，NSSAAF可以根据匿名签约永久标识的匿名域信息，从一个或多个外部鉴权设备中选择一个外部鉴权设备，并向该外部鉴权设备发送协议请求消息。
示例性地，匿名域信息指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识，例如，匿名域信息指示网络标识4，则NSSAAF选择一个网络标识4对应的网络的外部鉴权设备，并向其发送协议请求消息，请求对终端设备进行鉴权。
在一种可能的设计方式中，本申请实施例提供的通信方法，还可以包括：S409，外部鉴权设备与终端设备进行鉴权流程，或AUSF对终端设备进行鉴权流程。
也就是说，S409是对终端设备进行鉴权的过程，本申请对此不进行具体阐述。
可选地，终端设备与外部鉴权服务器执行鉴权流程，并生成根密钥(master key，MSK)。
基于图4所示的通信方法，UDM接收包括匿名域信息的匿名签约隐藏标识，该匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识，根据匿名域信息和配置信息确定鉴权指示信息，该鉴权指示信息用于指示鉴权的方式，配置信息包括外部鉴权方式对应的一个或者多个网络的标识、和/或内部鉴权方式对应的一个或者多个网络的标识，如此，可以成功确定对终端设备进行鉴权的方式。
图5为本申请实施例提供的另一种通信方法的流程示意图。图5可以与图4结合使用，在步骤S409外部鉴权设备与终端设备之间鉴权成功后可执行图5所示的通信方法。
如图5所示，该通信方法包括如下步骤：
S501，NSSAAF向AUSF发送认证响应消息。相应地，AUSF接收来自NSSAAF的认证响应消息。
可选地，认证响应消息可以包括真实签约永久标识、鉴权成功消息和/或根密钥MSK。
示例性地，真实签约永久标识是外部鉴权设备进行鉴权的过程中所使用的信任状对应的身份信息。
一些实施例中，真实签约永久标识可以包括真实域信息、和真实用户名信息。关于真实签约永久标识的具体实现方式可参照上述真实SUPI的实现方式，此处不再详细赘述。
可选地，真实域信息可用于指示外部鉴权设备进行鉴权的过程中所使用的信任状所属的网络的域名。可选地，真实用户名信息用于标识终端设备例如真实用户名信息可用于指示终端设备的唯一身份。
也就是说，外部鉴权设备使用真实签约永久标识对终端设备进行鉴权，认为真实签约永久标识是终端设备的真实的SUPI。
示例性地，鉴权成功消息可用于指示对终端设备鉴权成功。例如指示在上述S409中鉴权成功。
示例性地，根密钥MSK是外部鉴权设备与终端设备鉴权过程中生成的密钥，其申请方法会因为不同的鉴权方法而不同，本申请实施例不限定其生成方法。
在一种可能的设计方式中，本申请实施例提供的通信方法，还可以包括：S512，外部鉴权设备向NSSAAF发送协议响应消息。相应地，NSSAAF接收来自外部鉴权设 备的协议响应消息。
可选地，协议响应消息可以包括真实签约永久标识，还可以包括鉴权成功消息、和/或根密钥MSK。
也就是说，真实签约永久标识、鉴权成功消息、和/或根密钥MSK可以是外部鉴权设备通过NSSAAF向AUSF发送的。
S502，AUSF响应于鉴权成功消息，根据根密钥、真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息。
在一种可能的设计方式中，上述S502可以包括下述步骤五至步骤六。
步骤五，AUSF根据根密钥，生成中间密钥Kausf。
关于根密钥MSK的具体实现方式可参照上述S501，此处不再赘述。
步骤六，AUSF根据中间密钥Kausf以及真实签约永久标识，生成网络侧第一验证信息。
示例性地，AUSF可以根据中间密钥Kausf、功能信息、真实签约永久标识、网络侧计数器值中的至少两个，确定网络侧第一验证信息。
可选地，功能信息用于指示真实签约永久标识的使用场景，例如，应用于SNPN网络、SUPI鉴权(authentication)等。功能信息可以是字符串。
可选地，网络侧计数器值为大于或等于0的整数，网络侧计数器值的初始值可以为0。例如，AUSF本地可以维护一个计数器，网络侧计数器值为AUSF本地维护的计数器当前存储的数值，每计算一次网络侧第一验证信息，计数器的值加1。又例如，网络侧计数器值可以为一个随机数。
示例性地，可以通过下述公式(1)计算确定的网络侧第一验证信息。
SNPN_MACI_AUSF＝KDF(Kausf_1，第一输入参数，第二输入参数)(1)
上述公式(1)中，第一输入参数为真实签约永久标识。第二输入参数是可选的，第二输入参数可以为一个或多个输入参数。比如，第二输入参数为功能信息和/或网络侧计数器值。
上述公式(1)中，SNPN_MACI_AUSF为网络侧第一验证信息，例如为MAC值，表示AUSF在SNPN网络场景下计算的MAC值。Kausf_1为中间密钥Kausf。KDF()表示密钥派生函数(key derivation function，KDF)。
S503，AUSF向AMF发送鉴权认证响应消息。相应地，AMF接收来自AUSF的鉴权认证响应消息。
可选地，鉴权认证响应消息可以包括网络侧第一验证信息、鉴权成功消息、网络侧计数器值、和/或中间密钥Kseaf。
示例性地，在执行了上述S502获得网络侧第一验证信息、鉴权成功消息和/或网络侧计数器值的情况下，AUSF可以将网络侧第一验证信息、鉴权成功消息和/或网络侧计数器值发给AMF，以通过AMF发给终端设备。中间密钥Kseaf可以是AUSF生成的。
可选地，AUSF可以根据根密钥，生成中间密钥Kausf，根据中间密钥Kausf生成中间密钥Kseaf。
S504，AMF向终端设备发送NAS SMC消息。相应地，终端设备接收来自AMF 的NAS SMC消息。
可选地，NAS SMC消息可以包括网络侧第一验证信息、鉴权成功消息、和/或网络侧计数器值。
S505，终端设备判断终端侧第一验证信息与网络侧第一验证信息是否一致。
若网络侧第一验证信息与终端侧第一验证信息相同，则终端设备确定真实签约永久标识与真实签约永久标识相同，外部鉴权设备进行鉴权的过程中所使用的信任状对应的身份信息与终端设备侧的信任状对应的身份信息相同，终端设备确定AUSF是真实的，否则，真实签约永久标识与真实签约永久标识不相同，终端设备确定AUSF是虚假的，外部鉴权设备在鉴权过程中采用的真实签约永久标识不是终端设备的真实的SUPI。其中，AUSF是真实的或者是虚假的等同于终端设备认为所接入的网络是真实的或者是虚假的。
在一种可能的设计方式，本申请实施例提供的通信方法还可以包括：终端设备响应于鉴权成功消息，根据根密钥、真实签约永久标识和网络侧计数器值，生成终端侧第一验证信息。
一些实施例中，上述终端设备根据根密钥、真实签约永久标识和网络侧计数器值，生成终端侧第一验证信息，可以包括下述步骤七至步骤八。
步骤七，终端设备根据根密钥，生成中间密钥Kausf。
可选地，根密钥可以是终端设备在上述S409中的鉴权流程中生成的。
步骤八，终端设备根据中间密钥Kausf、真实签约永久标识和网络侧计数器值，生成终端侧第一验证信息。
一些实施例中，终端侧第一验证信息可以是终端设备根据中间密钥、功能信息、真实签约永久标识、网络侧计数器值中的至少两个确定的。
可选地，中间密钥Kausf可以是根据根密钥MSK生成的。
可选地，功能信息用于指示真实签约永久标识的使用场景，例如，应用于SNPN网络、SUPI鉴权(authentication)等。功能信息可以是字符串。
一些实施例中，真实签约永久标识可以包括真实域信息和真实用户名信息，真实用户名信息用于标识终端设备。关于真实签约永久标识的具体实现方式可参照上述真实SUPI的实现方式，此处不再详细赘述。
可选地，网络侧计数器值的实现方式可参照上述S502，此处不再赘述。
示例性地，可以通过公式(1)计算确定的终端侧第一验证信息，其中，终端侧第一验证信息用XSNPN_MACI_AUSF表示，可以为MAC值，表示终端设备在SNPN网络场景下期望的MAC值。其中，第一输入参数为真实签约永久标识。
需要说明的是，在认证响应消息包括真实签约永久标识的情况下，图5所示的通信方法可以包括上述S502至S505。AUSF可以通过AMF向终端设备发送网络侧第一验证信息和网络侧计数器值，终端设备可以确定网络侧第一验证信息与终端侧第一验证信息是否相同。
在认证响应消息包括鉴权成功消息的情况下，图5所示的通信方法可以包括上述S503至S504。此时，AUSF可以通过AMF向终端设备发送鉴权成功消息，终端设备可以根据鉴权成功消息获得AUSF是真实的，并继续执行下述S506。可以不执行AUSF 生成网络侧第一验证信息、以及终端设备生成终端侧第一验证信息并比较是否一致的步骤。
也就是说，终端设备可以通过网络侧第一验证信息与终端侧第一验证信息确定AUSF是否是真实的，或者，可以通过是否鉴成功来确定AUSF是否是真实的，若鉴权成功，则AUSF是真实的，若鉴权失败，则AUSF不是真实的。
S506，终端设备AMF发送N1消息。相应地，AMF接收来自终端设备的N1消息。
可选地，N1消息可以包括终端侧第二验证信息和/或终端侧计数器值。
在一种可能的设计方式中，本申请实施例提供的通信方法，还可以包括：终端设备根据根密钥、真实签约永久标识和终端侧计数器值，生成终端侧第二验证信息。
可选地，终端侧计数器值与生成终端侧的第一验证信息的网络侧的计数器值可以不相等。
例如，在终端侧第一验证信息与网络侧第一验证信息一致的情况下，终端设备根据根密钥以及真实签约永久标识，生成终端侧第二验证信息。对应终端设备通过网络侧第一验证信息与终端侧第一验证信息确定AUSF是否是真实的。
又例如，在接收到鉴权成功消息的情况下，终端设备根据根密钥、真实签约永久标识和终端侧计数器值，生成终端侧第二验证信息。对应终端设备通过是否鉴权成功确定AUSF是否是真实的。
示例性地，上述终端设备根据根密钥、真实签约永久标识和终端侧计数器值，生成终端侧第二验证信息，可以包括：终端设备根据根密钥，生成中间密钥Kausf，根据中间密钥Kausf、真实签约永久标识和终端侧计数器值，生成终端侧第二验证信息。
一些实施例中，终端侧第二验证信息可以是终端设备根据中间密钥、功能信息、真实签约永久标识、和终端侧计数器值中的至少两个确定的。
需要说明的是，中间密钥、功能信息、和真实签约永久标识的实现方式可参照上述S505，此处不再赘述。
示例性地，终端侧计数器值为大于或等于0的整数，终端侧计数器值的初始值可以为0。例如，终端设备本地可以维护一个计数器，终端侧计数器值为终端设备本地维护的计数器当前存储的数值，每计算一次终端侧第二验证信息，计数器的值加1。又例如，终端侧计数器值可以为一个随机数。
示例性地，可以通过公式(1)计算确定的终端侧第二验证信息。终端侧第二验证信息可以用SNPN_MACI_UE表示，可以为MAC值，SNPN_MACI_UE表示终端设备在SNPN网络场景下计算的MAC值。其中，第一输入参数为真实签约永久标识。在终端设备收到网络侧第一验证信息的情况下，功能信息可以包括对收到网络侧第一验证信息的确认或响应。
S507，AMF向AUSF发送鉴权认证中间消息。相应地，AUSF接收来自AMF的鉴权认证中间消息。
可选地，鉴权认证中间消息可以包括终端侧第二验证信息和/或终端侧计数器值。
S508，AUSF判断终端侧第二验证信息与网络侧第二验证信息是否一致。
若终端侧第二验证信息与网络侧第二验证信息相同，则AUSF确定真实签约永久标识与真实签约永久标识相同，外部鉴权设备进行鉴权的过程中所使用的信任状对应 的身份信息与终端设备侧的信任状对应的身份信息相同，AUSF确定终端设备是真实的；否则，真实签约永久标识与真实签约永久标识不相同，AUSF确定终端设备是虚假的。
在一种可能的设计方式中，本申请实施例提供的通信方法，还可以包括：AUSF根据根密钥、真实签约永久标识和终端侧计数器值，生成网络侧第二验证信息。
示例性地，上述AUSF根据根密钥、真实签约永久标识和终端侧计数器值，生成网络侧第二验证信息可以包括：AUSF根据根密钥，生成中间密钥Kausf，根据中间密钥Kausf、真实签约永久标识和终端侧计数器值，生成网络侧第二验证信息。
一些实施例中，网络侧第二验证信息可以是AUSF根据中间密钥Kausf、功能信息、真实签约永久标识、和终端侧计数器值中的至少两个确定的。
需要说明的是，中间密钥Kausf、功能信息的实现方式可参照上述S502，终端侧计数器值的实现方式可参照上述S506，此处不再赘述。
示例性地，可以通过公式(1)计算网络侧第二验证信息。网络侧第二验证信息可以用XSNPN_MACI_UE表示，XSNPN_MACI_UE表示AUSF在SNPN网络场景下期望的MAC值。其中，第一输入参数为真实签约永久标识。在终端设备收到网络侧第一验证信息的情况下，功能信息可以包括对收到网络侧第一验证信息的确认或响应。
如此，可以完成终端设备与网络侧的双向认证，终端设备认为网络是真实的，网络认为终端设备是真实的。
S509，在终端侧第二验证信息与网络侧第二验证信息一致的情况下，AUSF向UDM发送鉴权结果确认请求消息。相应地，UDM接收来自AUSF的鉴权结果确认请求消息。
可选地，鉴权结果确认请求消息可以包括真实签约永久标识、鉴权结果指示信息、和/或匿名签约永久标识。鉴权结果指示信息指示终端设备鉴权成功，鉴权结果指示信息用于指示主鉴权流程成功。相应地，UDM会根据该指示信息，记录终端设备鉴权成功。
S510，UDM保存真实签约永久标识和鉴权结果指示信息。
可选地，UDM可以保存真实签约永久标识、鉴权结果指示信息、和/或匿名签约永久标识。
示例性地，UDM生成匿名签约永久标识(参照上述S403)后，可以为该匿名签约永久标识建立一个表项，以记录其后续是否鉴权成功。从而，UDM接收到真实签约永久标识后，可以将真实签约永久标识直接存储入这个表项、或将匿名签约永久标识替换为真实签约永久标识、将真实签约永久标识直接存储入这个表项并将匿名签约永久标识删除。
或者，UDM并未对匿名签约永久标识建立表项，收到鉴权结果确认请求消息后，建立表项，可以包括真实签约永久标识，可选地，还可以包括匿名签约永久标识。
一些实施例中，UDM可以向外部网络请求匿名签约永久标识对应的签约数据，供UDM所在的网络使用，或者，UDM可以使用外部网络公用的签约数据作为该匿名签约永久标识对应的签约数据。
S511，UDM向AUSF发送鉴权结果确认响应消息。相应地，AUSF接收来自UDM 的鉴权结果确认响应消息。
基于图5所示的通信方法，通过确认终端设备侧的验证信息与网络侧的验证信息是否相同，来确定用于进行鉴权的真实签约永久标识与真实签约永久标识是否相同，如此，可以完成终端设备与网络侧的双向认证，终端设备认为网络是真实的，网络认为终端设备是真实的。
图6为本申请实施例提供的又一种通信方法的流程示意图。图6可以与图4结合使用，在步骤S409外部鉴权设备与终端设备之间鉴权成功后可执行图6所示的通信方法。
如图6所示，该通信方法包括如下步骤：
S601，NSSAAF向AUSF发送认证响应消息。相应地，AUSF接收来自NSSAAF的认证响应消息。
关于S601、以及认证响应消息的具体实现方式可参照上述S501，此处不再赘述。
在一种可能的设计方式中，本申请实施例提供的通信方法，还可以包括：S610，外部鉴权设备向NSSAAF发送协议响应消息。相应地，NSSAAF接收来自外部鉴权设备的协议响应消息。
关于S610、以及协议响应消息的具体实现方式可参照上述S511，此处不再赘述。
S602，可选地，AUSF判断匿名域信息与真实域信息是否匹配。
示例性地，匿名域信息为匿名签约永久标识中的域信息，真实域信息为真实签约永久标识中的域信息，AUSF可以根据真实签约永久标识中的域信息与匿名签约永久标识中的域信息是否匹配，来确定用于鉴权的真实签约永久标识与终端设备是否属于同一网络。如此，可以避免外部鉴权设备进行鉴权的真实签约永久标识不属于匿名签约永久标识对应的网络。
例如，若匿名域信息与真实域信息匹配，则用于鉴权的真实签约永久标识的真实域信息与匿名域信息是相同网络的。可以保存真实签约永久标识。若匿名域信息与真实域信息不匹配，则真实签约永久标识与终端设备不属于同一网络，外部鉴权设备对终端设备鉴权失败。
可选地，匿名域信息可以是从匿名签约永久标识中获取的，匿名签约永久标识可以是通过上述S403中鉴权获取响应消息接收的。
可选地，真实域信息可以是从真实签约永久标识中获取的，或者，认证响应消息中包括真实域信息。
在一种可能的设计方式中，判断匿名域信息与真实域信息是否匹配这一动作可以由NSSAAF(例如NSSAAF网元)执行，例如S603，NSSAAF判断匿名域信息与真实域信息是否匹配。需要说明的是，关于S603的具体实现方式与上述S602类似，将AUSF替换为NSSAAF即可。
可选地，NSSAAF可以将匿名域信息与真实域信息是否匹配的结果发给AUSF，例如通过认证响应消息发送，该认证响应消息可以包括鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
S604，在所述真实域信息与所述匿名域信息匹配的情况下，AUSF向UDM发送鉴权结果确认请求消息。相应地，UDM接收来自AUSF的鉴权结果确认请求消息。
关于S604、以及鉴权结果确认请求消息的具体实现方式可参照上述S509，此处不再赘述。
S605，UDM保存真实签约永久标识和鉴权结果指示信息。
关于S605的具体实现方式可参照上述S510，此处不再赘述。
S606，UDM向AUSF发送鉴权结果确认响应消息。相应地，AUSF接收来自UDM的鉴权结果确认响应消息。
关于S606的具体实现方式可参照上述S511，此处不再赘述。S607，AUSF根据根密钥以及真实签约永久标识，生成中间密钥Kausf。
在步骤S602执行的情况下，AUSF可以只使用真实签约永久标识中的用户身份信息部分生成中间密钥Kausf。真实签约永久标识中的用户身份信息可以是username部分，也可以是IMSI。本申请实施例不做限定。在步骤S602没有执行的情况下，该真实签约永久标识为SUPI的值。即包括username和realm。
可选地，中间密钥Kausf可用于密钥推演。比如推演Kseaf。
示例性地，AUSF可以根据真实签约永久标识和根密钥确定中间密钥Kausf，并将第一密钥Kausf作为根密钥推演密钥Kseaf。
S608，AUSF向AMF发送鉴权认证响应消息。相应地，AMF接收来自AUSF的鉴权认证响应消息。
可选地，鉴权认证响应消息可以包括如下一项或多项：鉴权成功消息、真实签约永久标识、和/或中间密钥Kseaf。
S609，AMF向终端设备发送NAS SMC消息。相应地，终端设备接收来自AMF的NAS SMC消息。
可选地，NAS SMC消息可以包括如下一项或多项：鉴权成功消息。
等，可参照上述S302，此处不再赘述。
基于图6所示的通信方法，AUSF根据匿名域信息和真实域信息，确定外部鉴权设备进行鉴权的过程中所使用的真实签约永久标识与终端设备侧的真实签约永久标识是否相同，若相同，则可以完成终端设备与网络侧的双向认证，终端设备认为网络是真实的，网络认为终端设备是真实的。
图7为本申请实施例提供的又一种通信方法的流程示意图。图7可以与图4结合使用，在步骤S409外部鉴权设备与终端设备之间鉴权成功后可执行图7所示的通信方法。
如图7所示，该通信方法包括如下步骤：
S701，NSSAAF向AUSF发送认证响应消息。相应地，AUSF接收来自NSSAAF的认证响应消息。
关于S701、以及认证响应消息的具体实现方式可参照上述S501，此处不再赘述。
在一种可能的设计方式中，本申请实施例提供的通信方法，还可以包括：S712，外部鉴权设备向NSSAAF发送协议响应消息。相应地，NSSAAF接收来自外部鉴权设备的协议响应消息。
关于S712、以及协议响应消息的具体实现方式可参照上述S511，此处不再赘述。
S702，AUSF根据根密钥，生成中间密钥Kausf。
可选地，AUSF可以根密钥确定中间密钥Kausf，并将中间密钥Kausf作为根密钥推演中间密钥Kseaf。
需要说明的是，S702中确定中间密钥Kausf的方法与S604中确定中间密钥Kausf的方法不同，S604中根据真实签约永久标识和根密钥确定中间密钥Kausf。
S703，AUSF向AMF发送鉴权认证响应消息。相应地，AMF接收来自AUSF的鉴权认证响应消息。
可选地，鉴权认证响应消息可以包括如下一项或多项：鉴权成功消息、中间密钥Kseaf、和/或真实签约永久标识。
S704，AMF向终端设备发送NAS SMC消息。相应地，终端设备接收来自AMF的NAS SMC消息。
可选地，NAS SMC消息可以包括如下一项或多项：鉴权成功消息。鉴权成功消息用于指示对终端设备鉴权成功。
可选地，NAS SMC消息可参照上述S302，此处不再赘述。
S705，终端设备响应于鉴权成功消息，根据根密钥，生成中间密钥Kausf，根据中间密钥Kausf生成中间密钥Kseaf。
S706，终端设备与AMF进行NAS SMC流程。
终端设备与AMF采用中间密钥Kseaf、侧真实签约永久标识、真实签约永久标识、和中间密钥Kseaf，执行NAS SMC流程。
关于S706的具体实现方式可参照上述图3所示的方法，此处不再赘述。
S707，在与所述终端设备成功执行NAS SMC流程的情况下，AMF向所述AUSF发送鉴权认证结果消息。相应地，AUSF接收来自AMF的鉴权认证结果消息。
可选地，鉴权认证结果消息可以包括鉴权结果指示信息，鉴权结果指示信息包括指示对终端设备鉴权成功的信息，例如可指示真实签约用户永久标识与真实签约用户永久标识相同。
可选地，鉴权认证结果消息本身就可以告知AUSF与终端设备交互的NAS SMC流程成功。
参照上述图3中的阐述，NAS SMC流程成功，可得出用于进行鉴权的真实签约永久标识与终端设备的真实签约永久标识相同。如此，可以完成终端设备与网络侧的双向认证，终端设备认为网络是真实的，网络认为终端设备是真实的。
可选地，鉴权结果指示信息可用于指示外部鉴权设备进行鉴权的过程中所使用的真实签约永久标识与终端设备侧的真实签约永久标识相同。
S708，AUSF向AMF发送鉴权认证结果响应消息。相应地，AMF接收来自AUSF的鉴权认证结果响应消息。
S709，AUSF向UDM发送鉴权结果确认请求消息。相应地，UDM接收来自AUSF的鉴权结果确认请求消息。
关于S709、以及鉴权结果确认请求消息的具体实现方式可参照上述S509，此处不再赘述。
需要说明的是，本申请对S708与S709执行的先后顺序不进行限定。
S710，UDM保存真实签约永久标识和鉴权结果指示信息。
关于S710的具体实现方式可参照上述S510，此处不再赘述。
S711，UDM向AUSF发送鉴权结果确认响应消息。相应地，AUSF接收来自UDM的鉴权结果确认响应消息。
关于S711的具体实现方式可参照上述S511，此处不再赘述。
需要说明的是，上述S709至S711可以在上述S701之后执行，或者，上述S709至S711可以在上述S708之后执行，用于在对真实SUPI的鉴权成功的情况下，再让UDM记录，避免在鉴权失败的情况下，还需要通知UDM删除鉴权记录的额外的信令开销。本申请对此不进行限定。
基于图7所示的通信方法，在鉴权流程后执行NAS SMC流程，NAS SMC流程成功，可得出用于鉴权的真实签约永久标识与终端设备的真实签约永久标识相同，从而外部鉴权设备进行鉴权的过程中所使用的信任状对应的身份信息与终端设备侧的信任状对应的身份信息相同。如此，可以完成终端设备与网络侧的双向认证，终端设备认为网络是真实的，网络认为终端设备是真实的。
本申请中，除特殊说明外，各个实施例之间相同或相似的部分可以互相参考。在本申请中各个实施例、以及各实施例中的各个实施方式/实施方法/实现方法中，如果没有特殊说明以及逻辑冲突，不同的实施例之间、以及各实施例中的各个实施方式/实施方法/实现方法之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例、以及各实施例中的各个实施方式/实施方法/实现方法中的技术特征根据其内在的逻辑关系可以组合形成新的实施例、实施方式、实施方法、或实现方法。以下所述的本申请实施方式并不构成对本申请保护范围的限定。
以上结合图1-图7详细说明了本申请实施例提供的通信方法。以下结合图8-图10详细说明本申请实施例提供的通信装置。
图8为可用于执行本申请实施例提供的通信方法的一种通信装置的结构示意图。通信装置800可以是接入和移动性管理功能、或鉴权服务器功能、或统一数据管理、或网络切片和独立非公共网络特定的鉴权和授权功能、或终端设备、或外部鉴权设备，也可以是应用于接入和移动性管理功能、或鉴权服务器功能、或统一数据管理、或网络切片和独立非公共网络特定的鉴权和授权功能、或终端设备、或外部鉴权设备中的芯片或者其他具有相应功能的部件。如图8所示，通信装置800可以包括处理器801。可选地，通信装置800还可以包括存储器802和收发器803中的一个或多个。其中，处理器801可以与存储器802和收发器803中的一个或多个耦合，如可以通过通信总线连接，处理器801也可以单独使用。
下面结合图8对通信装置800的各个构成部件进行具体的介绍：
处理器801是通信装置800的控制中心，可以是一个处理器，也可以是多个处理元件的统称。例如，处理器801是一个或多个中央处理器(central processing unit，CPU)，也可以是特定集成电路(application specific integrated circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)。
其中，处理器801可以通过运行或执行存储在存储器802内的软件程序，以及调 用存储在存储器802内的数据，执行通信装置800的各种功能。
在具体的实现中，作为一种实施例，处理器801可以包括一个或多个CPU，例如图8中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，通信装置800也可以包括多个处理器，例如图8中所示的处理器801和处理器804。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个通信设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
可选地，存储器802可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储通信设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储通信设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储通信设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器802可以和处理器801集成在一起，也可以独立存在，并通过通信装置800的输入/输出端口(图8中未示出)与处理器801耦合，本申请实施例对此不作具体限定。
示例性地，输入端口可用于实现上述任一方法实施例中接入和移动性管理功能、或鉴权服务器功能、或统一数据管理、或网络切片和独立非公共网络特定的鉴权和授权功能、或终端设备、或外部鉴权设备执行的接收功能，输出端口可用于实现上述任一方法实施例中由接入和移动性管理功能、或鉴权服务器功能、或统一数据管理、或网络切片和独立非公共网络特定的鉴权和授权功能、或终端设备、或外部鉴权设备执行的发送功能。
其中，所述存储器802可用于存储执行本申请方案的软件程序，并由处理器801来控制执行。上述具体实现方式可以参考下述方法实施例，此处不再赘述。
可选地，收发器803，用于与其他通信装置之间的通信。例如，通信装置800为统一数据管理时，收发器803可以用于与鉴权服务器功能、和/或其他网元通信。又例如，通信装置800为鉴权服务器功能时，收发器803可以用于与自网络切片和独立非公共网络特定的鉴权和授权功能、接入和移动性管理功能、统一数据管理、和/或其他网元通信。又例如，通信装置800为终端设备时，收发器803可以用于与接入和移动性管理功能、和/或其他网元通信。又例如，通信装置800为接入和移动性管理功能时，收发器803可以用于与终端设备、鉴权服务器功能、和/或其他网元通信。又例如，通信装置800为网络切片和独立非公共网络特定的鉴权和授权功能时，收发器803可以用于与鉴权服务器功能、外部鉴权设备和/或其他网元通信。又例如，通信装置800为外部鉴权设备时，收发器803可以用于与鉴权服务器功能、外部鉴权设备和/或其他网元通信。此外，收发器803可以包括接收器和发送器(图8中未单独示出)。其中，接收器用于实现接收功能，发送器用于实现发送功能。收发器803可以和处理器801集成在一起，也可以独立存在，并通过通信装置800的输入/输出端口(图8中未示出)与处理器801耦合，本申请实施例对此不作具体限定。
需要说明的是，图8中示出的通信装置800的结构并不构成对该通信装置的限定，实际的通信装置可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
上述图1-图7中统一数据管理的动作可以由图8所示的通信装置800中的处理器801调用存储器802中存储的应用程序代码以指令统一数据管理执行，本实施例对此不作任何限制。
上述图1-图7中鉴权服务器功能的动作可以由图8所示的通信装置800中的处理器801调用存储器802中存储的应用程序代码以指令鉴权服务器功能执行，本实施例对此不作任何限制。
上述图1-图7中终端设备的动作可以由图8所示的通信装置800中的处理器801调用存储器802中存储的应用程序代码以指令终端设备执行，本实施例对此不作任何限制。
上述图1-图7中接入和移动性管理功能的动作可以由图8所示的通信装置800中的处理器801调用存储器802中存储的应用程序代码以指令接入和移动性管理功能执行，本实施例对此不作任何限制。
上述图1-图7中网络切片和独立非公共网络特定的鉴权和授权功能的动作可以由图8所示的通信装置800中的处理器801调用存储器802中存储的应用程序代码以指令网络切片和独立非公共网络特定的鉴权和授权功能执行，本实施例对此不作任何限制。
上述图1-图7中外部鉴权设备的动作可以由图8所示的通信装置800中的处理器801调用存储器802中存储的应用程序代码以指令外部鉴权设备执行，本实施例对此不作任何限制。
通信装置800可执行上述方法实施例中的接入和移动性管理功能、或鉴权服务器功能、或统一数据管理、或网络切片和独立非公共网络特定的鉴权和授权功能、或终端设备、或外部鉴权设备所涉及的任一种或多种可能的设计方式。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
图9为本申请实施例提供的另一种通信装置的结构示意图。为了便于说明，图9仅示出了该通信装置的主要部件。
该通信装置900包括收发模块901、和处理模块902。该通信装置900可以是前述方法实施例中的鉴权服务器功能、或统一数据管理、或网络切片和独立非公共网络特定的鉴权和授权功能、或终端设备、或外部鉴权设备。收发模块901，也可以称为收发单元，用以实现上述任一方法实施例中由鉴权服务器功能、或统一数据管理、或网络切片和独立非公共网络特定的鉴权和授权功能、或终端设备、或外部鉴权设备执行的收发功能。
需要说明的是，收发模块901可以包括接收模块和发送模块(图9中未示出)。其中，接收模块用于接收来自其他设备的数据和/或信令；发送模块用于向其他设备发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。该收发模块可以由收发电路、收发机、收发器或者通信接口构成。
处理模块902，可以用于实现上述任一方法实施例中由鉴权服务器功能、或统一数据管理、或网络切片和独立非公共网络特定的鉴权和授权功能、或终端设备、或外部鉴权设备执行的处理功能。该处理模块902可以为处理器。
在本实施例中，该通信装置900以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定ASIC，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到该通信装置900可以采用图8所示的通信装置800的形式。
比如，图8所示的通信装置800中的处理器801可以通过调用存储器802中存储的计算机执行指令，使得上述方法实施例中的通信方法被执行。
具体的，图9中的收发模块901和处理模块902的功能/实现过程可以通过图8所示的通信装置800中的处理器801调用存储器802中存储的计算机执行指令来实现。或者，图9中的处理模块902的功能/实现过程可以通过图8所示的通信装置800中的处理器801调用存储器802中存储的计算机执行指令来实现，图9中的收发模块901的功能/实现过程可以通过图8中所示的通信装置800中的收发器803来实现。
由于本实施例提供的通信装置900可执行上述通信方法，因此其所能获得的技术效果可参考上述方法实施例，在此不再赘述。
图10为本申请实施例提供的又一种通信装置的结构示意图。为了便于说明，图10仅示出了该通信装置的主要部件。
该通信装置1000包括发送模块1001和接收模块1002。该通信装置1000可以是前述方法实施例中的接入和移动性管理功能。发送模块1001，也可以称为发送单元，用以实现上述任一方法实施例中由接入和移动性管理功能执行的发送功能。接收模块1001，也可以称为接收单元，用以实现上述任一方法实施例中由接入和移动性管理功能执行的接收功能。
需要说明的是，发送模块1001和接收模块1002可以分开设置，也可以集成在一个模块中，即收发模块。本申请对于接收模块和发送模块的具体实现方式，不做具体限定。该收发模块可以由收发电路、收发机、收发器或者通信接口构成。
可选地，通信装置1000还可以包括处理模块1003和存储模块，该存储模块存储有程序或指令。当处理模块1003执行该程序或指令时，使得通信装置1000可以执行上述任一方法实施例所述的方法。
处理模块1003，可以用于实现上述任一方法实施例中由接入和移动性管理功能执行的处理功能。该处理模块1003可以为处理器。
在本实施例中，该通信装置1000以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定ASIC，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到该通信装置1000可以采用图8所示的通信装置800的形式。
比如，图8所示的通信装置800中的处理器801可以通过调用存储器802中存储的计算机执行指令，使得上述方法实施例中的通信方法被执行。
具体的，图10中的处理模块和存储模块的功能/实现过程可以通过图8中所示的通信装置800中的收发器803来实现。图10中的处理模块的功能/实现过程可以通过图8所示的通信装置800中的处理器801调用存储器802中存储的计算机执行指令来实现，
由于本实施例提供的通信装置1000可执行上述通信方法，因此其所能获得的技术效果可参考上述方法实施例，在此不再赘述。
在一种可能的设计方案中，图9所示出的通信装置900可适用于图1和图2所示出的通信系统中，执行图4-图7所示的通信方法中的统一数据管理的功能。
其中，收发模块901，用于接收来自鉴权服务器功能的鉴权获取请求消息。
处理模块902，用于根据匿名域信息和配置信息，确定对终端设备进行鉴权的鉴权方式。
收发模块901，还用于向鉴权服务器功能发送鉴权获取响应消息。
其中，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权方式包括外部鉴权方式或者内部鉴权方式，配置信息包括外部鉴权方式对应的一个或者多个网络的标识、和/或内部鉴权方式对应的一个或者多个网络的标识。鉴权获取响应消息包括用于指示鉴权方式的鉴权指示信息。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置900还可以包括存储模块(图9中未示出)，该存储模块存储有程序或指令。当处理模块902执行该程序或指令时，使得通信装置900可以执行图4-图7所示的通信方法中的统一数据管理的功能。
需要说明的是，通信装置900可以是统一数据管理，也可以是可设置于统一数据管理的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置900的技术效果可以参考图4-图7所示的通信方法的技术效果，此处不再赘述。
在另一种可能的设计方案中，图9所示出的通信装置900可适用于图1和图2所示出的通信系统中，执行图3-图7所示的通信方法中的鉴权服务器功能的功能。
其中，收发模块901，用于向统一数据管理发送鉴权获取请求消息。
收发模块901，还用于接收来自统一数据管理的鉴权获取响应消息。
处理模块902，用于根据鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息。
收发模块901，还用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息。
在真实域信息与匿名域信息匹配的情况下，收发模块901，还用于向统一数据管理发送鉴权结果确认请求消息。
可选地，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，鉴权指示信息用于指示对 终端设备进行鉴权的鉴权方式。匿名签约永久标识包括匿名域信息。鉴权方式包括外部鉴权方式或者内部鉴权方式。认证请求消息用于请求对终端设备进行鉴权，认证请求消息包括匿名签约永久标识。认证响应消息包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置900还可以包括存储模块(图9中未示出)，该存储模块存储有程序或指令。当处理模块902执行该程序或指令时，使得通信装置900可以执行图3-图7所示的通信方法中的鉴权服务器功能的功能。
需要说明的是，通信装置900可以是鉴权服务器功能，也可以是可设置于鉴权服务器功能的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置900的技术效果可以参考图3-图7所示的通信方法的技术效果，此处不再赘述。
在另一种可能的设计方案中，图9所示出的通信装置900可适用于图1和图2所示出的通信系统中，执行图3-图7所示的通信方法中的鉴权服务器功能的功能。
其中，收发模块901，用于向统一数据管理发送鉴权获取请求消息。
收发模块901，还用于接收来自统一数据管理的鉴权获取响应消息。
收发模块901，还用于根据鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息。
收发模块901，还用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息。
处理模块902，用于响应于鉴权成功消息，根据根密钥、真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息。
收发模块901，还用于向接入和移动性管理功能发送鉴权认证响应消息，鉴权认证响应消息包括鉴权成功消息、网络侧第一验证信息和网络侧计数器值。
收发模块901，还用于接收来自接入和移动性管理功能的鉴权认证中间消息。
处理模块902，还用于根据根密钥、真实签约永久标识和终端侧计数器值，生成网络侧第二验证信息。
处理模块902，还用于判断终端侧第二验证信息与网络侧第二验证信息是否一致。
在终端侧第二验证信息与网络侧第二验证信息一致的情况下，收发模块901，还用于向统一数据管理发送鉴权结果确认请求消息。
可选地，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，鉴权指示信息用于指示对终端设备进行鉴权的鉴权方式。匿名签约永久标识包括匿名域信息。鉴权方式包括外部鉴权方式或者内部鉴权方式。认证请求消息用于请求对终端设备进行鉴权，认证请求消息包括匿名签约永久标识。认证响应消息包括真实签约永久标识、鉴权成功消息 和根密钥，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权认证中间消息包括终端侧第二验证信息和终端侧计数器值。鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置900还可以包括存储模块(图9中未示出)，该存储模块存储有程序或指令。当处理模块902执行该程序或指令时，使得通信装置900可以执行图3-图7所示的通信方法中的鉴权服务器功能的功能。
需要说明的是，通信装置900可以是鉴权服务器功能，也可以是可设置于鉴权服务器功能的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置900的技术效果可以参考图3-图7所示的通信方法的技术效果，此处不再赘述。
在另一种可能的设计方案中，图9所示出的通信装置900可适用于图1和图2所示出的通信系统中，执行图3-图7所示的通信方法中的鉴权服务器功能的功能。
其中，收发模块901，用于向统一数据管理发送鉴权获取请求消息。
收发模块901，还用于接收来自统一数据管理的鉴权获取响应消息。
处理模块902，用于根据鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息。
收发模块901，还用于接收来自网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息。
收发模块901，还用于向接入和移动性管理功能发送鉴权认证响应消息。
收发模块901，还用于接收来自接入和移动性管理功能的鉴权认证结果消息。
响应于鉴权结果指示信息，收发模块901，还用于向统一数据管理发送鉴权结果确认请求消息。
可选地，鉴权获取请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识。鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，鉴权指示信息用于指示对终端设备进行鉴权的鉴权方式。匿名签约永久标识包括匿名域信息。鉴权方式包括外部鉴权方式或者内部鉴权方式。认证请求消息用于请求对终端设备进行鉴权，认证请求消息包括匿名签约永久标识。认证响应消息包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权认证响应消息包括真实签约永久标识、和/或鉴权成功消息。鉴权认证结果消息包括鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。鉴权结果确认请求消息包括真实签约永久标识和鉴权结果指示信息。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置900还可以包括存储模块(图9中未示出)，该存储模块存储 有程序或指令。当处理模块902执行该程序或指令时，使得通信装置900可以执行图3-图7所示的通信方法中的鉴权服务器功能的功能。
需要说明的是，通信装置900可以是鉴权服务器功能，也可以是可设置于鉴权服务器功能的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置900的技术效果可以参考图3-图7所示的通信方法的技术效果，此处不再赘述。
在另一种可能的设计方案中，图9所示出的通信装置900可适用于图1和图2所示出的通信系统中，执行图3-图7所示的通信方法中的终端设备的功能。
在未获得公钥的情况下，处理模块902，用于确定匿名签约隐藏标识。
收发模块901，用于向接入和移动性管理功能发送注册请求消息。
其中，匿名签约隐藏标识包括匿名域信息、匿名用户名信息和路由指示符，匿名域信息用于指示能够对通信装置进行鉴权的鉴权设备所属的网络的标识，匿名用户名信息为缺省值。注册请求消息包括匿名签约隐藏标识。
在一种可能的设计方式中，处理模块902，还用于与外部鉴权服务器执行鉴权流程，并生成根密钥。收发模块901，用于接收来自接入和移动性管理功能的非接入层安全模式命令消息，非接入层安全模式命令消息包括鉴权成功消息。处理模块902，还用于响应于鉴权成功消息，根据根密钥以及真实签约永久标识，生成中间密钥。其中，鉴权成功消息用于指示对通信装置鉴权成功。真实签约永久标识包括真实用户名信息，真实用户名信息用于标识通信装置。
在一种可能的设计方式中，处理模块902，还用于与外部鉴权服务器执行鉴权流程，并生成根密钥。收发模块901，用于接收来自接入和移动性管理功能的非接入层安全模式命令消息。处理模块902，还用于响应于鉴权成功消息，根据根密钥、真实签约永久标识和网络侧计数器值，生成终端侧第一验证信息。处理模块902，还用于判断终端侧第一验证信息与网络侧第一验证信息是否一致。在终端侧第一验证信息与网络侧第一验证信息一致的情况下，处理模块902，还用于根据根密钥、真实签约永久标识和终端侧计数器值，生成终端侧第二验证信息。收发模块901，还用于向接入和移动性管理功能发送N1消息。
其中，非接入层安全模式命令消息包括鉴权成功消息、网络侧第一验证信息和网络侧计数器值，鉴权成功消息用于指示对通信装置鉴权成功。真实签约永久标识包括真实用户名信息，真实用户名信息用于标识通信装置。N1消息包括终端侧第二验证信息和终端侧计数器值。
在一种可能的设计方式中，处理模块902，还用于根据根密钥，生成中间密钥，根据中间密钥、真实签约永久标识和网络侧计数器值，生成终端侧第一验证信息。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置900还可以包括存储模块(图9中未示出)，该存储模块存储有程序或指令。当处理模块902执行该程序或指令时，使得通信装置900可以执行图3-图7所示的通信方法中终端设备的功能。
需要说明的是，通信装置900可以是终端设备，也可以是可设置于终端设备的芯 片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置900的技术效果可以参考图3-图7所示的通信方法的技术效果，此处不再赘述。
在另一种可能的设计方案中，图9所示出的通信装置900可适用于图1和图2所示出的通信系统中，执行图4-图7所示的通信方法中的网络切片和独立非公共网络特定的鉴权和授权功能的功能。
其中，收发模块901，用于接收来自鉴权服务器功能的认证请求消息。
收发模块901，还用于接收来自外部鉴权设备的协议响应消息。
处理模块902，用于判断匿名域信息与真实域信息是否匹配。
在真实域信息与匿名域信息匹配的情况下，收发模块901，还用于向鉴权服务器功能发送认证响应消息。
其中，认证请求消息可以包括匿名签约永久标识。匿名签约永久标识包括匿名域信息。协议响应消息可以包括真实签约永久标识，还可以包括鉴权成功消息、和/或根密钥MSK。认证响应消息可以包括鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置900还可以包括存储模块(图9中未示出)，该存储模块存储有程序或指令。当处理模块902执行该程序或指令时，使得通信装置900可以执行图4-图7所示的通信方法中网络切片和独立非公共网络特定的鉴权和授权功能的功能。
需要说明的是，通信装置900可以是网络切片和独立非公共网络特定的鉴权和授权功能，也可以是可设置于网络切片和独立非公共网络特定的鉴权和授权功能的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置900的技术效果可以参考图4-图7所示的通信方法的技术效果，此处不再赘述。
在一种可能的设计方案中，图10所示出的通信装置1000可适用于图1和图2所示出的通信系统中，执行图4-图7所示的通信方法中的接入和移动性管理功能。
其中，接收模块1002，用于接收来自终端设备的注册请求消息。
发送模块1001，还用于向鉴权服务器功能发送鉴权认证请求消息。
接收模块1002，还用于接收来自鉴权服务器功能的鉴权认证响应消息。
发送模块1001，还用于在与终端设备成功执行非接入层安全模式命令流程的情况下，向鉴权服务器功能发送鉴权认证结果消息。
其中，注册请求消息包括匿名签约隐藏标识，匿名签约隐藏标识包括匿名域信息、匿名用户名信息和路由指示符，匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识，匿名用户名信息为缺省值。鉴权认证请求消息包括匿名签约隐藏标识。鉴权认证响应消息包括真实签约永久标识、和/或鉴权成功消息，真实签约永久标识包括真实用户名信息，真实用户名信息用于标识终端设备，鉴权成功消息用于指示对终端设备鉴权成功。鉴权认证结果消息包括真实签约永久标识和鉴权结果指示信息，鉴权结果指示信息指示终端设备鉴权成功。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置1000还可以包括处理模块1003和存储模块(图10中未示出)，该存储模块存储有程序或指令。当处理模块1003执行该程序或指令时，使得通信装置1000可以执行图4-图7所示的通信方法中接入和移动性管理功能的功能。
需要说明的是，通信装置1000可以是接入和移动性管理功能，也可以是可设置于接入和移动性管理功能的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置1000的技术效果可以参考图4-图7所示的通信方法的技术效果，此处不再赘述。
本申请实施例提供一种通信系统。该通信系统包括：统一数据管理、和鉴权服务器功能。可选地，该通信系统还可以包括网络切片和独立非公共网络特定的鉴权和授权功能、接入和移动性管理功能、和外部鉴权服务器。
其中，统一数据管理用于执行上述方法实施例中统一数据管理的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
鉴权服务器功能用于执行上述方法实施例中鉴权服务器功能的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
网络切片和独立非公共网络特定的鉴权和授权功能用于执行上述方法实施例中网络切片和独立非公共网络特定的鉴权和授权功能的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
接入和移动性管理功能用于执行上述方法实施例中接入和移动性管理功能的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
外部鉴权服务器用于执行上述方法实施例中外部鉴权服务器的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
本申请实施例提供一种芯片系统，该芯片系统包括逻辑电路和输入/输出端口。其中，逻辑电路可用于实现本申请实施例提供的通信方法所涉及的处理功能，输入/输出端口可用于本申请实施例提供的通信方法所涉及的收发功能。
示例性地，输入端口可用于实现本申请实施例提供的通信方法所涉及的接收功能，输出端口可用于实现本申请实施例提供的通信方法所涉及的发送功能。
示例性的，通信装置800中的处理器可用于进行，例如但不限于，基带相关处理，通信装置800中的收发器可用于进行，例如但不限于，射频收发。上述器件可以分别设置在彼此独立的芯片上，也可以至少部分的或者全部的设置在同一块芯片上。例如，处理器可以进一步划分为模拟基带处理器和数字基带处理器。其中，模拟基带处理器可以与收发器集成在同一块芯片上，数字基带处理器可以设置在独立的芯片上。随着集成电路技术的不断发展，可以在同一块芯片上集成的器件越来越多，例如，数字基带处理器可以与多种应用处理器(例如但不限于图形处理器，多媒体处理器等)集成在同一块芯片之上。这样的芯片可以称为系统芯片(system on chip)。将各个器件独立设置在不同的芯片上，还是整合设置在一个或者多个芯片上，往往取决于产品设计的具体需要。本申请实施例对上述器件的具体实现形式不做限定。
在一种可能的设计中，该芯片系统还包括存储器，该存储器用于存储实现本申请 实施例提供的通信方法所涉及功能的程序指令和数据。
该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例提供一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序或指令，当计算机程序或指令在计算机上运行时，使得本申请实施例提供的通信方法被执行。
本申请实施例提供一种计算机程序产品，该计算机程序产品包括：计算机程序或指令，当计算机程序或指令在计算机上运行时，使得本申请实施例提供的通信方法被执行。
应理解，在本申请实施例中的处理器可以是中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的随机存取存储器(random access memory，RAM)可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
上述实施例，可以全部或部分地通过软件、硬件(如电路)、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令或计算机程序。在计算机上加载或执行所述计算机指令或计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存 在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系，但也可能表示的是一种“和/或”的关系，具体可参考前后文进行理解。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (30)

  1. 一种通信系统，其特征在于，所述通信系统包括：统一数据管理、和鉴权服务器功能；其中，
    所述鉴权服务器功能，用于向所述统一数据管理发送鉴权获取请求消息；其中，所述鉴权获取请求消息包括匿名签约隐藏标识，所述匿名签约隐藏标识包括匿名域信息，所述匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识；
    所述统一数据管理，用于接收来自所述鉴权服务器功能的所述鉴权获取请求消息，根据所述匿名域信息和配置信息，确定对所述终端设备进行鉴权的鉴权方式，向所述鉴权服务器功能发送鉴权获取响应消息；其中，所述鉴权方式包括外部鉴权方式或者内部鉴权方式，所述配置信息包括所述外部鉴权方式对应的一个或者多个网络的标识、和/或所述内部鉴权方式对应的一个或者多个网络的标识；所述鉴权获取响应消息包括指示所述鉴权方式的鉴权指示信息和匿名签约永久标识；所述匿名签约永久标识包括所述匿名域信息；
    所述鉴权服务器功能，还用于接收来自所述统一数据管理的所述鉴权获取响应消息；还用于根据所述鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息；其中，所述认证请求消息用于请求对所述终端设备进行鉴权，所述认证请求消息包括所述匿名签约永久标识。
  2. 根据权利要求1所述的通信系统，其特征在于，所述匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，所述匿名用户名信息为缺省值。
  3. 根据权利要求1或2所述的通信系统，其特征在于，所述系统还包括所述网络切片和独立非公共网络特定的鉴权和授权功能；
    所述网络切片和独立非公共网络特定的鉴权和授权功能，用于接收来自所述鉴权服务器功能的所述认证请求消息；向所述鉴权服务器功能发送认证响应消息；其中，所述认证响应消息包括真实签约永久标识、和/或鉴权成功消息，所述真实签约永久标识包括真实用户名信息，所述真实用户名信息用于标识所述终端设备，所述鉴权成功消息用于指示对所述终端设备鉴权成功；
    所述鉴权服务器功能，还用于接收来自所述网络切片和独立非公共网络特定的鉴权和授权功能的所述认证响应消息；向所述统一数据管理发送鉴权结果确认请求消息；其中，所述鉴权结果确认请求消息包括所述真实签约永久标识和鉴权结果指示信息，所述鉴权结果指示信息指示所述终端设备鉴权成功；
    所述统一数据管理，还用于接收来自所述鉴权服务器功能的所述鉴权结果确认请求消息，保存所述真实签约永久标识和所述鉴权结果指示信息。
  4. 根据权利要求3所述的通信系统，其特征在于，所述认证响应消息还包括根密钥；
    所述鉴权服务器功能，还用于根据所述根密钥以及所述真实签约永久标识，生成中间密钥。
  5. 根据权利要求1或2所述的通信系统，其特征在于，认证响应消息还包括根密钥，所述通信系统还包括：接入和移动性管理功能和所述网络切片和独立非公共网络特定的鉴权和授权功能；
    所述网络切片和独立非公共网络特定的鉴权和授权功能，用于接收来自所述鉴权服务器功能的所述认证请求消息，向所述鉴权服务器功能发送所述认证响应消息；其中，所述认证响应消息包括真实签约永久标识、和/或鉴权成功消息，所述真实签约永久标识包括真实用户名信息，所述真实用户名信息用于标识所述终端设备，所述鉴权成功消息用于指示对所述终端设备鉴权成功；
    所述鉴权服务器功能，还用于接收来自所述网络切片和独立非公共网络特定的鉴权和授权功能的所述认证响应消息；响应于所述鉴权成功消息，根据所述根密钥、所述真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息；向所述接入和移动性管理功能发送鉴权认证响应消息，所述鉴权认证响应消息包括所述鉴权成功消息、所述网络侧第一验证信息和所述网络侧计数器值；
    所述接入和移动性管理功能，用于接收来自所述鉴权服务器功能的所述鉴权认证响应消息；还用于向所述终端设备发送非接入层安全模式命令消息；其中，所述非接入层安全模式命令消息包括所述鉴权成功消息、所述网络侧第一验证信息和网络侧计数器值；
    所述接入和移动性管理功能，还用于向所述鉴权服务器功能发送鉴权认证中间消息；其中，所述鉴权认证中间消息包括终端侧第二验证信息和终端侧计数器值；
    所述鉴权服务器功能，还用于接收来自所述接入和移动性管理功能的所述鉴权认证中间消息；向所述统一数据管理发送鉴权结果确认请求消息；其中，所述鉴权结果确认请求消息包括所述真实签约永久标识和鉴权结果指示信息，所述鉴权结果指示信息指示所述终端设备鉴权成功；
    所述统一数据管理，还用于接收来自所述鉴权服务器功能的所述鉴权结果确认请求消息；保存所述真实签约永久标识和所述鉴权结果指示信息。
  6. 根据权利要求5所述的通信系统，其特征在于，
    所述鉴权服务器功能，还用于根据所述根密钥，生成中间密钥；根据所述中间密钥、所述真实签约永久标识和网络侧计数器值，生成所述网络侧第一验证信息。
  7. 根据权利要求1或2所述的通信系统，其特征在于，认证响应消息还包括根密钥，所述通信系统还包括：接入和移动性管理功能和所述网络切片和独立非公共网络特定的鉴权和授权功能；
    所述网络切片和独立非公共网络特定的鉴权和授权功能用于接收来自所述鉴权服务器功能的所述认证请求消息；向所述鉴权服务器功能发送所述认证响应消息；其中，所述认证响应消息包括真实签约永久标识、鉴权成功消息、和根密钥，所述真实签约永久标识包括真实用户名信息，所述真实用户名信息用于标识所述终端设备，所述鉴权成功消息用于指示对所述终端设备鉴权成功；
    所述鉴权服务器功能，还用于接收来自所述网络切片和独立非公共网络特定的鉴权和授权功能的所述认证响应消息；向所述接入和移动性管理功能发送鉴权认证响应消息；其中，所述鉴权认证响应消息包括所述真实签约永久标识、和/或所述鉴权成功消息、中间密钥Kseaf；
    所述接入和移动性管理功能，用于接收来自所述鉴权服务器功能的所述鉴权认证响应消息；还用于向终端设备发送非接入层安全模式命令消息；其中，所述非接入层 安全模式命令消息包括所述鉴权成功消息；
    在所述接入和移动性管理功能与所述终端设备成功执行非接入层安全模式命令流程的情况下，所述接入和移动性管理功能，还用于向所述鉴权服务器功能发送鉴权认证结果消息；其中，所述鉴权认证结果消息包括鉴权结果指示信息，所述鉴权结果指示信息指示所述终端设备鉴权成功；
    所述鉴权服务器功能，还用于接收来自所述接入和移动性管理功能的所述鉴权认证结果消息；向所述接入和移动性管理功能发送鉴权认证结果响应消息；
    所述接入和移动性管理功能，还用于接收来自所述鉴权服务器功能的所述鉴权认证结果响应消息；
    所述鉴权服务器功能，还用于向所述统一数据管理发送鉴权结果确认请求消息；其中，所述鉴权结果确认请求消息包括所述真实签约永久标识和所述鉴权结果指示信息；
    所述统一数据管理，还用于接收来自所述鉴权服务器功能的所述鉴权结果确认请求消息；还用于保存所述真实签约永久标识和所述鉴权结果指示信息。
  8. 一种通信方法，其特征在于，包括：
    接收来自鉴权服务器功能的鉴权获取请求消息；其中，所述鉴权获取请求消息包括匿名签约隐藏标识，所述匿名签约隐藏标识包括匿名域信息，所述匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识；
    根据所述匿名域信息和配置信息，确定对所述终端设备进行鉴权的鉴权方式；其中，所述鉴权方式包括外部鉴权方式或者内部鉴权方式，所述配置信息包括所述外部鉴权方式对应的一个或者多个网络的标识、和/或所述内部鉴权方式对应的一个或者多个网络的标识；
    向所述鉴权服务器功能发送鉴权获取响应消息；其中，所述鉴权获取响应消息包括用于指示所述鉴权方式的鉴权指示信息。
  9. 根据权利要求8所述的通信方法，其特征在于，所述根据所述匿名域信息和配置信息，确定对所述终端设备进行鉴权的鉴权方式，包括：
    在所述能够对所述终端设备进行鉴权的鉴权设备所属的网络的标识与所述外部鉴权方式对应的一个或者多个网络的标识匹配的情况下，确定对所述终端设备进行鉴权的鉴权方式是外部鉴权方式；或者，
    在所述能够对设备终端设备进行鉴权的鉴权设备所属的网络的标识与所述内部鉴权方式对应的一个或者多个网络的标识匹配的情况下，确定对所述终端设备进行鉴权的鉴权方式是内部鉴权方式。
  10. 根据权利要求8或9所述的通信方法，其特征在于，所述鉴权获取响应消息还包括匿名签约永久标识，所述匿名签约永久标识是根据所述匿名签约隐藏标识确定的，所述匿名签约永久标识包括所述匿名域信息。
  11. 根据权利要求8-10中任一项所述的通信方法，其特征在于，所述匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，所述匿名用户名信息为缺省值。
  12. 根据权利要求8-11中任一项所述的通信方法，其特征在于，所述方法还包括：
    接收来自所述鉴权服务器功能的鉴权结果确认请求消息；其中，所述鉴权结果确 认请求消息包括真实签约永久标识和鉴权结果指示信息，所述鉴权结果指示信息指示所述终端设备鉴权成功；所述真实签约永久标识包括真实用户名信息，所述真实用户名信息用于标识所述终端设备；
    保存所述真实签约永久标识和所述鉴权结果指示信息。
  13. 一种通信方法，其特征在于，包括：
    向统一数据管理发送鉴权获取请求消息；其中，所述鉴权获取请求消息包括匿名签约隐藏标识，所述匿名签约隐藏标识包括匿名域信息，所述匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识；
    接收来自所述统一数据管理的鉴权获取响应消息；其中，所述鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，所述鉴权指示信息用于指示对所述终端设备进行鉴权的鉴权方式；所述匿名签约永久标识包括所述匿名域信息；所述鉴权方式包括外部鉴权方式或者内部鉴权方式；
    根据所述鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息；其中，所述认证请求消息用于请求对所述终端设备进行鉴权，所述认证请求消息包括所述匿名签约永久标识；
    接收来自所述网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息；其中，所述认证响应消息包括真实签约永久标识、和/或鉴权成功消息，所述真实签约永久标识包括真实用户名信息，所述真实用户名信息用于标识所述终端设备，所述鉴权成功消息用于指示对所述终端设备鉴权成功；
    向所述统一数据管理发送鉴权结果确认请求消息；其中，所述鉴权结果确认请求消息包括所述真实签约永久标识和鉴权结果指示信息，所述鉴权结果指示信息指示所述终端设备鉴权成功。
  14. 根据权利要求13所述的通信方法，其特征在于，所述认证响应消息还包括根密钥，所述方法还包括：
    根据所述根密钥以及所述真实签约永久标识，生成中间密钥。
  15. 根据权利要求13或14所述的通信方法，其特征在于，所述匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，所述匿名用户名信息为缺省值。
  16. 一种通信方法，其特征在于，包括：
    向统一数据管理发送鉴权获取请求消息；其中，所述鉴权获取请求消息包括匿名签约隐藏标识，所述匿名签约隐藏标识包括匿名域信息，所述匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识；
    接收来自所述统一数据管理的鉴权获取响应消息；其中，所述鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，所述鉴权指示信息用于指示对所述终端设备进行鉴权的鉴权方式；所述匿名签约永久标识包括所述匿名域信息；所述鉴权方式包括外部鉴权方式或者内部鉴权方式；
    根据所述鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息；其中，所述认证请求消息用于请求对所述终端设备进行鉴权，所述认证请求消息包括所述匿名签约永久标识；
    接收来自所述网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息； 其中，所述认证响应消息包括真实签约永久标识、鉴权成功消息和根密钥，所述真实签约永久标识包括真实用户名信息，所述真实用户名信息用于标识所述终端设备，所述鉴权成功消息用于指示对所述终端设备鉴权成功；
    响应于所述鉴权成功消息，根据所述根密钥、所述真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息；
    向接入和移动性管理功能发送鉴权认证响应消息，所述鉴权认证响应消息包括所述鉴权成功消息、所述网络侧第一验证信息和所述网络侧计数器值；
    接收来自所述接入和移动性管理功能的鉴权认证中间消息；其中，所述鉴权认证中间消息包括终端侧第二验证信息和终端侧计数器值；
    向所述统一数据管理发送鉴权结果确认请求消息；其中，所述鉴权结果确认请求消息包括所述真实签约永久标识和鉴权结果指示信息，所述鉴权结果指示信息指示所述终端设备鉴权成功。
  17. 根据权利要求16所述的通信方法，其特征在于，所述匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，所述匿名用户名信息为缺省值。
  18. 根据权利要求16或17所述的通信方法，其特征在于，所述根据所述根密钥、所述真实签约永久标识和网络侧计数器值，生成网络侧第一验证信息，包括：
    根据所述根密钥，生成中间密钥；
    根据所述中间密钥、所述真实签约永久标识和所述网络侧计数器值，生成所述网络侧第一验证信息。
  19. 一种通信方法，其特征在于，包括：
    向统一数据管理发送鉴权获取请求消息；其中，所述鉴权获取请求消息包括匿名签约隐藏标识，所述匿名签约隐藏标识包括匿名域信息，所述匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识；
    接收来自所述统一数据管理的鉴权获取响应消息；其中，所述鉴权获取响应消息包括鉴权指示信息和匿名签约永久标识，所述鉴权指示信息用于指示对所述终端设备进行鉴权的鉴权方式；所述匿名签约永久标识包括所述匿名域信息；所述鉴权方式包括外部鉴权方式或者内部鉴权方式；
    根据所述鉴权指示信息，向网络切片和独立非公共网络特定的鉴权和授权功能发送认证请求消息；其中，所述认证请求消息用于请求对所述终端设备进行鉴权，所述认证请求消息包括所述匿名签约永久标识；
    接收来自所述网络切片和独立非公共网络特定的鉴权和授权功能的认证响应消息；其中，所述认证响应消息包括真实签约永久标识、和/或鉴权成功消息，所述真实签约永久标识包括真实用户名信息，所述真实用户名信息用于标识所述终端设备，所述鉴权成功消息用于指示对所述终端设备鉴权成功；
    向接入和移动性管理功能发送鉴权认证响应消息；其中，所述鉴权认证响应消息包括所述真实签约永久标识、和/或所述鉴权成功消息；
    接收来自所述接入和移动性管理功能的鉴权认证结果消息；其中，所述鉴权认证结果消息包括鉴权结果指示信息，所述鉴权结果指示信息指示所述终端设备鉴权成功；
    向所述统一数据管理发送鉴权结果确认请求消息；其中，所述鉴权结果确认请求 消息包括所述真实签约永久标识和所述鉴权结果指示信息。
  20. 根据权利要求19所述的通信方法，其特征在于，所述认证响应消息还包括根密钥，所述方法还包括：
    根据所述根密钥，生成中间密钥。
  21. 根据权利要求19或20所述的通信方法，其特征在于，所述匿名签约隐藏标识还包括匿名用户名信息和路由指示符，其中，所述匿名用户名信息为缺省值。
  22. 一种通信方法，其特征在于，包括：
    在未获得公钥的情况下，确定匿名签约隐藏标识；其中，所述匿名签约隐藏标识包括匿名域信息、匿名用户名信息和路由指示符，所述匿名域信息用于指示能够对终端设备进行鉴权的鉴权设备所属的网络的标识，所述匿名用户名信息为缺省值；
    向接入和移动性管理功能发送注册请求消息；其中，所述注册请求消息包括所述匿名签约隐藏标识。
  23. 根据权利要求22所述的通信方法，其特征在于，所述方法还包括：
    与外部鉴权设备执行鉴权流程，并生成根密钥；
    接收来自所述接入和移动性管理功能的非接入层安全模式命令消息，所述非接入层安全模式命令消息包括鉴权成功消息；其中，所述鉴权成功消息用于指示对所述终端设备鉴权成功；
    响应于所述鉴权成功消息，根据所述根密钥以及真实签约永久标识，生成中间密钥；其中，所述真实签约永久标识包括真实用户名信息，所述真实用户名信息用于标识所述终端设备。
  24. 根据权利要求22所述的通信方法，其特征在于，所述方法还包括：
    与外部鉴权设备执行鉴权流程，并生成根密钥；
    接收来自所述接入和移动性管理功能的非接入层安全模式命令消息；其中，所述非接入层安全模式命令消息包括鉴权成功消息、网络侧第一验证信息和网络侧计数器值，所述鉴权成功消息用于指示对所述终端设备鉴权成功；
    响应于所述鉴权成功消息，根据所述根密钥、真实签约永久标识和所述网络侧计数器值，生成终端侧第一验证信息；其中，所述真实签约永久标识包括真实用户名信息，所述真实用户名信息用于标识所述终端设备；
    判断所述终端侧第一验证信息与所述网络侧第一验证信息是否一致；
    在所述终端侧第一验证信息与所述网络侧第一验证信息一致的情况下，根据所述根密钥、所述真实签约永久标识和终端侧计数器值，生成终端侧第二验证信息；
    向所述接入和移动性管理功能发送N1消息；其中，所述N1消息包括所述终端侧第二验证信息和所述终端侧计数器值。
  25. 根据权利要求24所述的通信方法，其特征在于，所述根据所述根密钥、真实签约永久标识和所述网络侧计数器值，生成终端侧第一验证信息，包括：
    根据所述根密钥，生成中间密钥；
    根据所述中间密钥、所述真实签约永久标识和所述网络侧计数器值，生成所述终端侧第一验证信息。
  26. 一种通信方法，其特征在于，包括：
    接收来自终端设备的注册请求消息；其中，所述注册请求消息包括匿名签约隐藏标识，所述匿名签约隐藏标识包括匿名域信息、匿名用户名信息和路由指示符，所述匿名域信息用于指示能够对所述终端设备进行鉴权的鉴权设备所属的网络的标识，所述匿名用户名信息为缺省值；
    向鉴权服务器功能发送鉴权认证请求消息；其中，所述鉴权认证请求消息包括所述匿名签约隐藏标识；
    接收来自所述鉴权服务器功能的鉴权认证响应消息；其中，所述鉴权认证响应消息包括真实签约永久标识、和/或鉴权成功消息，所述真实签约永久标识包括真实用户名信息，所述真实用户名信息用于标识所述终端设备，所述鉴权成功消息用于指示对所述终端设备鉴权成功；
    在与所述终端设备成功执行非接入层安全模式命令流程的情况下，向所述鉴权服务器功能发送鉴权认证结果消息；其中，所述鉴权认证结果消息包括所述真实签约永久标识和鉴权结果指示信息，所述鉴权结果指示信息指示所述终端设备鉴权成功。
  27. 一种通信装置，其特征在于，所述通信装置包括用于执行如权利要求8至26中任一项所述方法的单元或模块。
  28. 一种通信装置，其特征在于，所述通信装置包括：处理器；所述处理器，用于执行如权利要求8-26中任一项所述的通信方法。
  29. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得如权利要求8-26中任一项所述的通信方法被执行。
  30. 一种计算机程序产品，其特征在于，所述计算机程序产品包括：计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得如权利要求8-26中任一项所述的通信方法被执行。
PCT/CN2022/128443 2021-10-30 2022-10-28 通信方法、装置及系统 WO2023072275A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22886150.6A EP4422235A1 (en) 2021-10-30 2022-10-28 Communication method, apparatus and system
US18/650,700 US20240284174A1 (en) 2021-10-30 2024-04-30 Communication method, apparatus, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111278529.6 2021-10-30
CN202111278529.6A CN116074822A (zh) 2021-10-30 2021-10-30 通信方法、装置及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/650,700 Continuation US20240284174A1 (en) 2021-10-30 2024-04-30 Communication method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2023072275A1 true WO2023072275A1 (zh) 2023-05-04

Family

ID=86159074

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/128443 WO2023072275A1 (zh) 2021-10-30 2022-10-28 通信方法、装置及系统

Country Status (4)

Country Link
US (1) US20240284174A1 (zh)
EP (1) EP4422235A1 (zh)
CN (1) CN116074822A (zh)
WO (1) WO2023072275A1 (zh)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109587680A (zh) * 2017-09-29 2019-04-05 华为技术有限公司 参数的保护方法、设备和系统

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109587680A (zh) * 2017-09-29 2019-04-05 华为技术有限公司 参数的保护方法、设备和系统

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
ERICSSON: "Anonymous SUCI for N5GC", 3GPP TSG-SA3 MEETING #100E, S3-201881, 7 August 2020 (2020-08-07), XP051916405 *
ERICSSON: "Authentication method selection and SUPI retrieval for N5GC", 3GPP TSG-SA3 MEETING #101E, S3-203170, 30 October 2020 (2020-10-30), XP051949746 *
ERICSSON: "Removing Editor's notes in I.2.2.z", 3GPP TSG-SA3 MEETING #104E-AD-HOC, S3-213514, vol. SA WG3, no. e-meeting; 20210927 - 20210930, 20 September 2021 (2021-09-20), XP052062967 *
LENOVO, MOTOROLA MOBILITY: "Anonymous SUCI for N5GC", 3GPP TSG-SA3 MEETING #101E, S3-203309, vol. SA WG3, no. e-meeting; 20201109 - 20201120, 30 October 2020 (2020-10-30), XP051949887 *

Also Published As

Publication number Publication date
US20240284174A1 (en) 2024-08-22
EP4422235A1 (en) 2024-08-28
CN116074822A (zh) 2023-05-05

Similar Documents

Publication Publication Date Title
US11140545B2 (en) Method, apparatus, and system for protecting data
WO2019157909A1 (zh) 一种通信方法及通信装置
US20240298174A1 (en) Method and systems for authenticating ue for accessing non-3gpp service
CN116723507B (zh) 针对边缘网络的终端安全方法及装置
WO2021031055A1 (zh) 通信方法及装置
US11722890B2 (en) Methods and systems for deriving cu-up security keys for disaggregated gNB architecture
TWI685267B (zh) 一種接入控制的方法及設備
WO2024067619A1 (zh) 通信方法和通信装置
WO2023246942A1 (zh) 通信方法及装置
CN113395697B (zh) 传输寻呼信息的方法和通信装置
US11595370B2 (en) Parameter exchange during emergency access using extensible authentication protocol messaging
WO2023072275A1 (zh) 通信方法、装置及系统
CN116528234B (zh) 一种虚拟机的安全可信验证方法及装置
WO2024160127A1 (zh) 通信方法、装置及系统
WO2023143459A1 (zh) 授权方法及装置
WO2024164968A1 (zh) 一种通信方法及通信装置
US20240373215A1 (en) Security configuration update in communication networks
CN116546490A (zh) 密钥生成方法及装置
WO2023246457A1 (zh) 安全决策协商方法及网元
WO2022237838A1 (zh) 通信方法和通信装置
WO2024165058A1 (zh) 通信方法及装置
WO2024087038A1 (zh) 一种通信方法和通信装置
WO2023147767A1 (zh) 网络校验的方法和装置
WO2024037215A1 (zh) 通信方法及装置
WO2023142102A1 (en) Security configuration update in communication networks

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22886150

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022886150

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2022886150

Country of ref document: EP

Effective date: 20240522